WorkforceROI Xpede Weak Password Encryption Vulnerability

Bugtraq ID:	4344
Class:	Design Error
CVE:	CVE-2002-0486
Remote:	No
Local:	Yes
Published:	Mar 22 2002 12:00AM
Updated:	Jul 11 2009 11:56AM
Credit:	Reported by Gregory Duchemin <[email protected]>.
Vulnerable:	WorkforceROI Xpede 7.0 WorkforceROI Xpede 4.1
Not Vulnerable:

WorkforceROI Xpede Weak Password Encryption Vulnerability

An issue has been reported in Xpede, which could lead to a compromise of user authentication information.

Reportedly, Xpede cookies containing username and password data is stored using a weak encryption method. Therefore if a user obtains access to cookies reisding on a system, he/she may be able to reveal authentication information of Xpede users.

WorkforceROI Xpede Weak Password Encryption Vulnerability

An exploit has been provided by Gregory Duchemin ([email protected]).

• /data/vulnerabilities/exploits/Xdeep.pl

WorkforceROI Xpede Weak Password Encryption Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

WorkforceROI Xpede Weak Password Encryption Vulnerability

References:

• WorkforceROI Homepage (WorkforceROI)