Computer Associates Unicenter Common Services Plaintext Password Vulnerability

Bugtraq ID:	11277
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 29 2004 12:00AM
Updated:	Sep 29 2004 12:00AM
Credit:	This vulnerability was announced by the vendor.
Vulnerable:	Computer Associates Unicenter ServicePlus Service Desk 6.0 Computer Associates Unicenter Network and Systems Management 3.0 Computer Associates Common Services 3.0 Computer Associates Common Services 2.2 Computer Associates Common Services 2.1 Computer Associates Common Services 2.0 Computer Associates Common Services 1.1 Computer Associates Common Services 1.0
Not Vulnerable:

Computer Associates Unicenter Common Services Plaintext Password Vulnerability

Computer Associates Unicenter Common Services is reported prone to a plaintext password storage vulnerability. It is reported that the database Server Admin password is stored in plaintext in the certain installation batch files.

A local attacker may exploit this vulnerability, if they have read access to the batch files in question.

Computer Associates Unicenter Common Services Plaintext Password Vulnerability

There is no exploit required.

Computer Associates Unicenter Common Services Plaintext Password Vulnerability

Solution:
It is reported that the vendor has released a patch 'QO58447' and post-installation steps to address this vulnerability. This information is only available to customers that have a valid support account:

http://supportconnect.ca.com/sc/solcenter/sol_detail.jsp?aparno=QO58447&os=NT&returninput=0

Computer Associates Unicenter Common Services Plaintext Password Vulnerability

References:

• Vendor Home Page (Computer Associates)