PowerQuest DeployCenter May Disclose Passwords to Local Users
|
|
SecurityTracker Alert ID: 1011081
|
|
SecurityTracker URL: http://securitytracker.com/id?1011081
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Aug 28 2004
|
Impact: Disclosure of authentication information
|
Exploit Included: Yes
|
Version(s): 5.5
|
Description: A vulnerability was reported in PowerQuest DeployCenter. A local user may be able to obtain a password for access to network shares.
William Reyor reported that a local user can trigger an error in the 'stuffit.com' binary used to decrypt stored passwords from the
'stuffit.dat' file. A local user can run a command (such as 'stuffit /f:stuffit.dat') four or more times to cause the application
to display the password at the command prompt.
It is also reported that the system uses insecure LAN Manager authentication.
|
Impact: A local user can cause the system to display the password used to access network shares.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: sea.symantec.com/content/product.cfm?productid=8 (Links to External Site)
|
Cause: Exception handling error
|
Underlying OS: Windows (Any)
|
Reported By: opticfiber <opticfiber@topsight.net>
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 27 Aug 2004 6:49:37 -0000
From: opticfiber <>
Subject: [Full-Disclosure] Power Quest Deploy Center 5.5 boot disks
|
A vulnerability has been found in power quest deploy center 5.5 boot disks.
Normally when creating a PQDI network boot disk, the administrator has the
option to have the machine login to a domain controller to access a shared
resource. Besides the authentication method using lm (insecure), a buffer
overflow exists in stuffit.com.
Stuffit.com is the control mechanism that allows the power quest boot disk
to decode/decrypt stored password(s) in stuffit.dat. A typical line in the
disks autoexec.bat file looks like: stuffit /f:stuffit.dat , this loads the
stored password resident in memory. However, if this same command is
repeated 4 or more times at the command prompt the program overflows,
actually printing the clear text password right on the command prompt.
William Reyor
Topsight.net
________________________________________________
This mail was sent by UebiMiau 2.5
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
|
|
