Webroot Software Spy Sweeper Enterprise Plain Text Password Storage Weakness
BID:11588
Info
Webroot Software Spy Sweeper Enterprise Plain Text Password Storage Weakness
| Bugtraq ID: | 11588 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 13 2004 12:00AM |
| Updated: | Mar 19 2015 09:11AM |
| Credit: | Discovery is credited to Frank Mileto <[email protected]>. |
| Vulnerable: |
Webroot Software Spy Sweeper Enterprise PHP PHP 5.0.2 PHP PHP 5.0.1 PHP PHP 5.0 .0 PHP PHP 4.3.8 PHP PHP 4.3.7 PHP PHP 4.3.6 PHP PHP 4.3.5 PHP PHP 4.3.4 PHP PHP 4.3.3 PHP PHP 4.3.2 PHP PHP 4.3.1 PHP PHP 4.3 PHP PHP 4.2.3 PHP PHP 4.2.2 PHP PHP 4.2.1 PHP PHP 4.2 .0 PHP PHP 4.1.2 PHP PHP 4.1.1 PHP PHP 4.1 .0 PHP PHP 4.0.7 PHP PHP 4.0.6 PHP PHP 4.0.5 PHP PHP 4.0.4 PHP PHP 4.0.3 PHP PHP 4.0.2 PHP PHP 4.0.1 PHP PHP 4.0 0 |
| Not Vulnerable: | |
Discussion
Webroot Software Spy Sweeper Enterprise Plain Text Password Storage Weakness
Spy Sweeper Enterprise stores administrative passwords in plaintext format, in the Windows registry.
As a result, these credentials could be exposed to other local users who have the permissions to access the registry.
All versions of Spy Sweeper Enterprise are considered vulnerable to this issue.
Spy Sweeper Enterprise stores administrative passwords in plaintext format, in the Windows registry.
As a result, these credentials could be exposed to other local users who have the permissions to access the registry.
All versions of Spy Sweeper Enterprise are considered vulnerable to this issue.
Exploit / POC
Webroot Software Spy Sweeper Enterprise Plain Text Password Storage Weakness
There is no exploit code required.
There is no exploit code required.
Solution / Fix
Webroot Software Spy Sweeper Enterprise Plain Text Password Storage Weakness
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Webroot Software Spy Sweeper Enterprise Plain Text Password Storage Weakness
References:
References:
- Spy Sweeper Enterprise Product Page (Webroot Software)