Blackboard Transact Multiple Insecure Password Handling Information Disclosure Vulnerabilities

Bugtraq ID:	42938
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 01 2010 12:00AM
Updated:	Sep 01 2010 12:00AM
Credit:	John Fisher
Vulnerable:
Not Vulnerable:

Blackboard Transact Multiple Insecure Password Handling Information Disclosure Vulnerabilities

Blackboard Transact is prone to multiple information-disclosure. These vulnerabilities include an insecure password storage vulnerability and an insecure password handling vulnerability.

Successful attacks can allow a local attacker to gain unauthorized access to the application's users' password information.

Versions prior to Blackboard Transact 3.6.0.2 (previously know as Blackboard Commerce Suite) are vulnerable; other versions may be affected.

Blackboard Transact Multiple Insecure Password Handling Information Disclosure Vulnerabilities

An attacker can leverage this issue using readily available tools.

Blackboard Transact Multiple Insecure Password Handling Information Disclosure Vulnerabilities

Solution:
Reports indicate vendor updates are available; this has not been confirmed. Contact the vendor for more information.

Blackboard Transact Multiple Insecure Password Handling Information Disclosure Vulnerabilities

References:

• Blackboard Transact - Homepage (Blackboard)
  
• Vulnerability Note VU#204055 - Blackboard Transact database credentials disclosu (US-CERT)