Spytech SpyAnywhere Plaintext Password Vulnerability

Bugtraq ID:	2754
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 22 2000 12:00AM
Updated:	May 22 2000 12:00AM
Credit:	Discovered and posted to Bugtraq by SNS Research <[email protected]> on May 22, 2001.
Vulnerable:	Spytech SpyAnywhere 1.50 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0
Not Vulnerable:	Spytech SpyAnywhere 2.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0

Spytech SpyAnywhere Plaintext Password Vulnerability

A flaw exists in SpyAnywhere which could enable a remote user to gain unauthorized access to the target system.

Authentication credentials are sent to the target system in plain text, therefore; a malicious attacker may be able to easily obtain this information using a sniffer.

Spytech SpyAnywhere Plaintext Password Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.