Computer Associates Unicenter Asset Manager Stored Secret Data Decryption Weakness
BID:7808
Info
Computer Associates Unicenter Asset Manager Stored Secret Data Decryption Weakness
| Bugtraq ID: | 7808 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 04 2003 12:00AM |
| Updated: | Jun 04 2003 12:00AM |
| Credit: | Discovery credited to Tor Houghton. |
| Vulnerable: |
Computer Associates Unicenter Asset Manager |
| Not Vulnerable: | |
Discussion
Computer Associates Unicenter Asset Manager Stored Secret Data Decryption Weakness
It has been reported that Unicenter Asset Manager stores password information in a way that may be easily recovered. Because of this, an attacker may be able to gain access to potentially sensitive resources.
It has been reported that Unicenter Asset Manager stores password information in a way that may be easily recovered. Because of this, an attacker may be able to gain access to potentially sensitive resources.
Exploit / POC
Computer Associates Unicenter Asset Manager Stored Secret Data Decryption Weakness
An exploit has been contributed by Tor Houghton:
An exploit has been contributed by Tor Houghton:
Solution / Fix
Computer Associates Unicenter Asset Manager Stored Secret Data Decryption Weakness
Solution:
The vendor has made fixes available via their eSupport web page. Customers should advised to refer to eSupport for updates.
Solution:
The vendor has made fixes available via their eSupport web page. Customers should advised to refer to eSupport for updates.
References
Computer Associates Unicenter Asset Manager Stored Secret Data Decryption Weakness
References:
References:
- eSupport Homepage (Computer Associates)
- Unicenter Asset Management Product Description (Computer Associates)
- CA Unicenter Password Recovery Tool (Tor Houghton