McKesson Horizon Clinical Infrastructure (HCI) Password Disclosure Vulnerability

Bugtraq ID:	36725
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	Oct 19 2009 12:00AM
Updated:	Oct 19 2009 11:08PM
Credit:	Anonymous
Vulnerable:	McKesson Horizon Clinical Infrastructure (HCI) 7.8 McKesson Horizon Clinical Infrastructure (HCI) 7.6 McKesson Horizon Clinical Infrastructure (HCI) 10.1 McKesson Horizon Clinical Infrastructure (HCI) 10.0
Not Vulnerable:

McKesson Horizon Clinical Infrastructure (HCI) Password Disclosure Vulnerability

McKesson Horizon Clinical Infrastructure (HCI) is prone to a local information-disclosure vulnerability because database passwords are hardcoded within the application.

Exploiting this issue may allow a local attacker to obtain sensitive information that may aid in further attacks.

HCI 7.6, 7.8, 10.0, and 10.1 are vulnerable. Other versions may also be affected.

McKesson Horizon Clinical Infrastructure (HCI) Password Disclosure Vulnerability

Attackers can use readily available tools to exploit this issue.

McKesson Horizon Clinical Infrastructure (HCI) Password Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

McKesson Horizon Clinical Infrastructure (HCI) Password Disclosure Vulnerability

References:

• Vendor Homepage (McKesson)
  
• McKesson Horizon Clinical Infrastructure (HCI) version 7.6/7.8/10.0/10.1 hardcod ([email protected])