Hotline Communications Hotline Connect Plain Text Password Vulnerability

Bugtraq ID:	4210
Class:	Design Error
CVE:	CVE-2002-0343
Remote:	No
Local:	Yes
Published:	Feb 28 2002 12:00AM
Updated:	Jul 11 2009 10:56AM
Credit:	Reported by Rense Buijen <[email protected]>.
Vulnerable:	Hotline Communications Hotline Connect 1.8.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0
Not Vulnerable:

Hotline Communications Hotline Connect Plain Text Password Vulnerability

Hotline Connect is an instant messaging type application maintained by Hotline Communications.

An issue has been reported in Hotline Connect which may potentially disclose authentication credentials to attackers.

Hotline Connect stores account information in plaintext on the local system in the same directory Hotline Bookmarks are stored.

Hotline Communications Hotline Connect Plain Text Password Vulnerability

No exploit code required.

Hotline Communications Hotline Connect Plain Text Password Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Hotline Communications Hotline Connect Plain Text Password Vulnerability

References:

• Hotline Homepage (Hotline Communications)