Shana Corporation's Informed Document Software May Disclose User Information Within the Document
|
|
SecurityTracker Alert ID: 1005295 |
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Sep 26 2002
|
Impact: Disclosure of system information, Disclosure of user information
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 3.05
|
Description: An information disclosure vulnerability was reported in Shana Corporation's Informed. An Informed document may contain information from the target user's system.
It is reported that Informed inadvertently accesses information from the system disk and pads the Informed document with this information.
A
user can view an Informed document with an editor to view the information at the end of the file.
According to the report, both
Informed Filler and Informed Designer are affected.
|
Impact: An Informed document may contain remnants of various user and system information.
|
Solution: The vendor has released a fixed version (4.0) of Informed Filler and Informed Designer. Contact the vendor for upgrade information.
|
Vendor URL: www.shana.com/products/default.asp (Links to External Site)
|
Cause: Access control error, Resource error
|
Underlying OS: MacOS, UNIX (OS X), Windows (Any)
|
Reported By: "sullo" <sullo@cirt.net>
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 25 Sep 2002 00:03:20 -0400
From: "sullo" <sullo@cirt.net>
Subject: Shana Informed 3.05 information disclosure
|
Shana Informed v3.05 stores random data in clear text
http://www.cirt.net/advisories/shana.shtml
Product Description:
Shana Corporation provides eForm solutions and is the developer of Informed.
Their solution is used by more than two million people around the world.
Shana's Informed has been chosen by a wide range of organizations in more
than 65 countries worldwide. Shana's customer base spans many industries,
notably the Aerospace and Digital Government sectors. Shana has strategic
technology partnerships with a number of companies, including FileNET
Corporation and Entrust Technologies. Other partners include Apple Computer,
EDS, Microsoft, NCR, Oracle, and Sierra.
Event Description:
Shana's Informed product accesses information from disk and pads it into the
Informed document. When an Informed document is opened with a hex editor or
Microsoft's Wordpad sensitive information may be stored in the clear at the very
bottom of the file. The information stored in the clear has been identified to have
come from other documents on a user's workstation has well as clear-text data
from the actual Informed file as well.
Risk Explanation:
The Informed files may contain sensitive personal or corporate information that
can be viewed by anyone has access to the encrypted file.
Applications Affected:
Informed Filler v3.05
Informed Designer v3.05.
Solution:
Upgrade to Shana's Informed Filler and Informed Designer release 4.0.
Timeline:
* The problem was reported to Shana via E-Mail on Saturday, June 29th 2002
4:20pm.
* A response from Shana was received on July 1st explaining that the
information had been passed on to the development team for evaluation.
* A follow-up was sent to Shana via E-Mail on Sunday, July 21st 2002 12:38pm
again requesting timeframes for addressing the security issue.
* A response acknowling the problema and detailing a fix was received on
Tuesday, July 23 2002 12:55pm.
Vendor Status:
Response: "Thank-you for bringing this issue to our attention. We have fixed the
issue in our newest release 4.0. Some file space allocation growth functions
were not "zeroing" out new disc space as the file grew. Unused blocks were
being captured into the form data, along with any data that may have resided on
that location of the drive. The complete file growth areas are now made null to
avoid any unwanted data from being captured. It may be worth noting that this
does not occur in Windows XP, as the operating system takes better care of this
on its own."
Contacts:
zel@cirt.net*
*(note that this message was sent on behalf of zel@cirt.net)
|
|
