Perforce Server Unauthorized Password Change Security Bypass Vulnerability

Bugtraq ID:	38591
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 08 2010 12:00AM
Updated:	Mar 08 2010 12:00AM
Credit:	McAfee
Vulnerable:	Perforce Perforce Server 2009.2
Not Vulnerable:

Perforce Server Unauthorized Password Change Security Bypass Vulnerability

Perforce Server is prone to a security-bypass vulnerability because it fails to adequately restrict access to the password-change feature.

An attacker can exploit this issue to change a user's password, thereby aiding in further attacks.

Perforce Server Unauthorized Password Change Security Bypass Vulnerability

Attackers can exploit this issue with readily available tools.

Perforce Server Unauthorized Password Change Security Bypass Vulnerability

Solution:
Reports indicate this issue will be addressed in the upcoming 2010.1 release.

Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Perforce Server Unauthorized Password Change Security Bypass Vulnerability

References:

• Perforce Server Homepage (Perforce Software)
  
• Protecting Your Critical Assets Lessons Learned from �??Operation Aurora�?� (McAfee)