Retrospect Backup Client CVE-2015-2864 Weak Password Security Vulnerability

Bugtraq ID:	75201
Class:	Design Error
CVE:	CVE-2015-2864
Remote:	Yes
Local:	No
Published:	Jun 15 2015 12:00AM
Updated:	Jun 15 2015 12:00AM
Credit:	Josep Pi Rodriguez and Pedro Guillen Nunez.
Vulnerable:	Retrospect Retrospect 8 Retrospect Retrospect 7
Not Vulnerable:	Retrospect Retrospect 12.0.2.116 Retrospect Retrospect 10.0.2.119 Retrospect Retrospect 10.0.2.104

Retrospect Backup Client CVE-2015-2864 Weak Password Security Vulnerability

Retrospect Backup Client is prone to a security vulnerability that may allow attackers to obtain sensitive information.

Attackers can exploit this issue with brute-force techniques to obtain passwords that can aid in further attacks.

Retrospect Backup Client CVE-2015-2864 Weak Password Security Vulnerability

An attacker can exploit this issue using readily available tools.

Retrospect Backup Client CVE-2015-2864 Weak Password Security Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Retrospect Backup Client CVE-2015-2864 Weak Password Security Vulnerability

References:

• CERT Vulnerability CVE-2015-2864 (Retrospect)
  
• Software Downloads and Updates (Retrospect)
  
• Vulnerability Note VU#101500 Retrospect Backup Client uses weak password hashing (CERT)