Xircom Rex 6000 Password Retrieval Vulnerability
BID:3574
Info
Xircom Rex 6000 Password Retrieval Vulnerability
| Bugtraq ID: | 3574 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 23 2001 12:00AM |
| Updated: | Nov 23 2001 12:00AM |
| Credit: | Discovered and posted to Bugtraq by Daniel Jonsson <[email protected]> on November 23, 2001. |
| Vulnerable: |
Xircom Rex 6000 |
| Not Vulnerable: | |
Discussion
Xircom Rex 6000 Password Retrieval Vulnerability
Xircom Rex 6000 PDA users can install Rextools on their desktop in order to manage the content on their MicroPDA device. This process involves the user connecting the PDA to a serial port (COMx) on the standalone system, and submitting a ten digit pin code in order to display the content from the PDA in Rextools.
A flaw exists in the transfer of the pin code information from the PDA to the Rextools application. The Rex 6000 sends the authentication information in plain text.
Xircom Rex 6000 PDA users can install Rextools on their desktop in order to manage the content on their MicroPDA device. This process involves the user connecting the PDA to a serial port (COMx) on the standalone system, and submitting a ten digit pin code in order to display the content from the PDA in Rextools.
A flaw exists in the transfer of the pin code information from the PDA to the Rextools application. The Rex 6000 sends the authentication information in plain text.
Exploit / POC
Xircom Rex 6000 Password Retrieval Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.