Van Dyke Software SecureFX SSH2 Authentication Password Persistence Weakness

Bugtraq ID:	6727
Class:	Design Error
CVE:	CVE-2003-0048
Remote:	No
Local:	Yes
Published:	Jan 29 2003 12:00AM
Updated:	Jul 11 2009 08:06PM
Credit:	Discovery credited to Knud Erik Højgaard <[email protected]>.
Vulnerable:	VanDyke SecureFX 2.1.2 VanDyke SecureFX 2.0.4
Not Vulnerable:	VanDyke SecureFX 2.1.3 VanDyke SecureFX 2.0.5

Van Dyke Software SecureFX SSH2 Authentication Password Persistence Weakness

It has been reported that SecureFX does not safely handle password information. As a result, a local user may be able to recover authentication passwords.

Van Dyke Software SecureFX SSH2 Authentication Password Persistence Weakness

No exploit is required for this weakness.

Van Dyke Software SecureFX SSH2 Authentication Password Persistence Weakness

Solution:
VanDyke Software has made fixes available:


VanDyke SecureFX 2.0.4

• Van Dyke Technologies SecureFX 2.0.5
  http://www.vandyke.com/download/securefx/2.0/index.html

VanDyke SecureFX 2.1.2

• Van Dyke Technologies SecureFX 2.1.3
  http://www.vandyke.com/download/securefx/index.html

Van Dyke Software SecureFX SSH2 Authentication Password Persistence Weakness

References:

• SecureFX Homepage (Van Dyke Technologies)
  
• iDEFENSE Security Advisory 01.28.03: SSH2 Clients Insecurely Store Passwords ("iDEFENSE Labs" )