CVE-2010-1487 - IBM Lotus Notes 7.0, 8.0, and 8.5 stores administrative credentials in cleartext in SURunAs.exe, whi

CVE-2010-1487

Summary

IBM Lotus Notes 7.0, 8.0, and 8.5 stores administrative credentials in cleartext in SURunAs.exe, which allows local users to obtain sensitive information by examining this file, aka SPR JSTN837SEG.

References

Vulnerable Configurations

cpe:2.3:a:ibm:lotus_notes:7.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:7.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.5:*:*:*:*:*:*:*

CVSS

Base:	2.1 (as of 19-09-2017 - 01:30)
Impact:
Exploitability:

CWE

CWE-255

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:L/AC:L/Au:N/C:P/I:N/A:N

oval via4

accepted

2015-06-15T04:00:09.976-04:00

class

vulnerability

contributors

name Aharon Chernin
organization DTCC
name Maria Mikhno
organization ALTX-SOFT

definition_extensions

comment IBM Lotus Notes is installed
oval oval:org.mitre.oval:def:11999
comment IBM Lotus Notes is installed
oval oval:org.mitre.oval:def:11999

description

IBM Lotus Notes 7.0, 8.0, and 8.5 stores administrative credentials in cleartext in SURunAs.exe, which allows local users to obtain sensitive information by examining this file, aka SPR JSTN837SEG.

family

windows

oval:org.mitre.oval:def:14725

status

accepted

submitted

2011-12-16T09:51:32.000-05:00

title

IBM Lotus Notes 7.0, 8.0, and 8.5 stores administrative credentials in cleartext in SURunAs.exe, which allows local users to obtain sensitive information by examining this file, aka SPR JSTN837SEG.

version

refmap via4

bid	39525
confirm	http://www-01.ibm.com/support/docview.wss?uid=swg21427073
secunia	39507

Last major update

19-09-2017 - 01:30

Published

20-04-2010 - 15:30

Last modified

19-09-2017 - 01:30