Shana Informed Information Disclosure Vulnerability
BID:5795
Info
Shana Informed Information Disclosure Vulnerability
| Bugtraq ID: | 5795 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Sep 25 2002 12:00AM |
| Updated: | Sep 25 2002 12:00AM |
| Credit: | Discovery credited to Sullo. |
| Vulnerable: |
Shana Informed Filler 3.5 Shana Informed Designer 3.5 |
| Not Vulnerable: |
Shana Informed Filler 4.0 Shana Informed Designer 4.0 |
Discussion
Shana Informed Information Disclosure Vulnerability
An information disclosure issue has been discovered in Shana Informed.
By opening encrypted documents created by Informed in a hex editor, it is potentially possible for an attacker to obtain sensitive information from the document, as well as arbitrary files located on the system.
It should be noted that documents created under on the Windows XP platform, are not vulnerable to this issue.
An information disclosure issue has been discovered in Shana Informed.
By opening encrypted documents created by Informed in a hex editor, it is potentially possible for an attacker to obtain sensitive information from the document, as well as arbitrary files located on the system.
It should be noted that documents created under on the Windows XP platform, are not vulnerable to this issue.
Exploit / POC
Shana Informed Information Disclosure Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
Shana Informed Information Disclosure Vulnerability
Solution:
The vendor has addressed the issue in Informed v4.0:
Shana Informed Designer 3.5
Shana Informed Filler 3.5
Solution:
The vendor has addressed the issue in Informed v4.0:
Shana Informed Designer 3.5
-
Shana Informed v4.0
http://www.shana.com
Shana Informed Filler 3.5
-
Shana Informed v4.0
http://www.shana.com
References
Shana Informed Information Disclosure Vulnerability
References:
References:
- Shana Informed Product Page (www.shana.com)