PT-2017-14349 · Nq · Nq Contacts Backup & Restore

Published 2017-10-29 · Updated 2019-10-03 · CVE-2017-15997

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NQ Contacts Backup & Restore version 1.1

Description The issue concerns the use of a static RC4 key for encryption in the application, which can allow an attacker to more easily gain access to user credentials by accessing the preferences XML file. This affects the security of user passwords stored locally.

Recommendations For version 1.1, consider disabling the use of RC4 encryption until a more secure encryption method can be implemented, or restrict access to the preferences XML file to minimize the risk of exploitation.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2017-15997

Affected Products

Nq Contacts Backup & Restore

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-15997 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15997 · Vendor Advisory
• https://1337sec.blogspot.de/2017/10/auditing-nq-contacts-backup-restore-11.html · Note