Positive Software H-Sphere Winbox敏感Logfile内容泄露漏洞-安全小百科

Positive Software H-Sphere Winbox敏感Logfile内容泄露漏洞

漏洞ID	1108765	漏洞类型	设计错误
发布时间	2005-05-09	更新时间	2005-10-20
CVE编号	CVE-2005-1606	CNNVD-ID	CNNVD-200505-1058
漏洞平台	Windows	CVSS评分	4.6

|漏洞来源

https://www.exploit-db.com/exploits/25636
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200505-1058

|漏洞详情

H-SphereWinbox2.4.2及2.4.3RC1在全域可读的日志文件中以纯文本形式储存敏感信息，如用户名和密码，本地用户可借此获取权限。

|漏洞EXP

source: http://www.securityfocus.com/bid/13559/info

It is reported that Positive Software H-Sphere Winbox stores user account information in a plaintext format inside of application log files.

As a result, user credentials could be exposed to other local users who have permissions to access the log files. 

C:HSphere.NETlogaction.log
C:HSphere.NETlogresources.log

|参考资料

来源:XF
名称:hsphere-information-disclosure(20522)
链接:http://xforce.iss.net/xforce/xfdb/20522
来源:BID
名称:13559
链接:http://www.securityfocus.com/bid/13559
来源:www.psoft.net
链接:http://www.psoft.net/misc/hsphere_winbox_security_update_passwd.html
来源:SECUNIA
名称:15287
链接:http://secunia.com/advisories/15287
来源:MISC
链接:http://exploitlabs.com/files/advisories/EXPL-A-2005-007-hsphere.txt
来源:OSVDB
名称:16239
链接:http://www.osvdb.org/16239

相关推荐: Ingenium Learning Management System密码HASH可逆漏洞

Ingenium Learning Management System密码HASH可逆漏洞漏洞ID 1107042 漏洞类型设计错误发布时间 2002-10-15 更新时间 2005-10-20 CVE编号 CVE-2002-1910 CNNVD-ID …

文章版权归作者所有，未经允许请勿转载。

THE END