PT-2017-7737 · Hitek · Automize

Published 2017-01-23 · Updated 2017-03-16 · CVE-2016-10104

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitek Software's Automize versions 10.0 through 10.25 Hitek Software's Automize versions 11.0 through 11.14

Description The issue allows an attacker to recover encrypted passwords for SSH/SFTP profiles due to the Read attribute being set for Users in sshProfiles.jsd. This can lead to Information Disclosure.

Recommendations For versions 10.0 through 10.25, restrict access to the sshProfiles.jsd file to minimize the risk of exploitation. For versions 11.0 through 11.14, consider disabling the Read attribute for Users in sshProfiles.jsd until a patch is available. As a temporary workaround, avoid using the SSH/SFTP profiles in Automize until the issue is resolved.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2016-10104

Affected Products

Automize

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-10104 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10104 · Vendor Advisory
• http://securityfocus.com/bid/96845 · Note
• https://rastamouse.me/guff/2016/automize · Note