Globe7 SIP Soft Phone Weak Password Obfuscation Information Disclosure Vulnerability

Bugtraq ID:	26195
Class:	Design Error
CVE:	CVE-2007-5790
Remote:	No
Local:	Yes
Published:	Oct 24 2007 12:00AM
Updated:	Nov 05 2007 11:35PM
Credit:	Sipera Systems discovered this vulnerability.
Vulnerable:	Globe7 Globe7 0
Not Vulnerable:

Globe7 SIP Soft Phone Weak Password Obfuscation Information Disclosure Vulnerability

Globe7 is prone to an information-disclosure vulnerability because it fails to adequately protect user account credentials.

Exploiting this issue could allow an attacker to access information that will result in unauthorized access to the related VoIP account.

Globe7 SIP Soft Phone Weak Password Obfuscation Information Disclosure Vulnerability

No specific exploit code is required to leverage this issue. An attacker can decrypt the affected passwords using readily available binary converters.

Globe7 SIP Soft Phone Weak Password Obfuscation Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Globe7 SIP Soft Phone Weak Password Obfuscation Information Disclosure Vulnerability

References:

• Vendor Homepage (Globe7)
  
• Globe7 VoIP Client uses weak encryption to store user credentials (Sipera Systems)