Pastel Accounting ACCUSER.DAT Obfuscation Weakness

Bugtraq ID:	7003
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Mar 03 2003 12:00AM
Updated:	Mar 03 2003 12:00AM
Credit:	Discovery of this issue is credited to blaqhatz.
Vulnerable:	Pastel Pastel Accounting 6.12 Pastel Pastel Accounting 6.1 Pastel Pastel Accounting 6.0
Not Vulnerable:

Pastel Accounting ACCUSER.DAT Obfuscation Weakness

Pastel Accounting is reported to store sensitive user and security information on the local system using a trivially reversible obfuscation method. This information is stored in the 'ACCUSER.DAT' file in each particular client folder. The information is encoded by rotating the characters in the original string. Malicious users with read access to this file may easily gain access to sensitive information. This will also permit malicious users with write access to the file to modify data, since the software does not verify the contents of this file any further.

This issue was reported in Pastel Account version 6.0-6.12. Other versions may also be affected.

Pastel Accounting ACCUSER.DAT Obfuscation Weakness

There is no exploit required.

Pastel Accounting ACCUSER.DAT Obfuscation Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Pastel Accounting ACCUSER.DAT Obfuscation Weakness

References:

• Pastel Homepage (Pastel)
  
• [blaqhatz] - Pastel Accounting application security issues ("l33t guy" )