Hamachi VPN Local Login Credentials Information Disclosure Vulnerability

Bugtraq ID:	28420
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Mar 24 2008 12:00AM
Updated:	Mar 25 2008 08:49PM
Credit:	Giuseppe `Evilcry` Bonfa
Vulnerable:	Applied Networking Hamachi 1.0.2.5
Not Vulnerable:

Hamachi VPN Local Login Credentials Information Disclosure Vulnerability

Hamachi VPN is prone to a local information-disclosure vulnerability because it fails to securely protect users' login credentials.

Attackers can exploit this issue to harvest VPN login credentials and gain unauthorized access to networks and resources protected by the VPN. This may lead to further attacks.

Hamachi 1.0.2.5 is vulnerable; other versions may also be affected.

Hamachi VPN Local Login Credentials Information Disclosure Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Hamachi VPN Local Login Credentials Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Hamachi VPN Local Login Credentials Information Disclosure Vulnerability

References:

• Hamachi Homepage (Applied Networking)
  
• Hamachi Password Disclosure Vulnerability ([email protected])