CVE-2007-0889 - Kiwi CatTools before 3.2.0 beta uses weak encryption ("reversible encoding") for passwords, account

CVE-2007-0889

Summary

Kiwi CatTools before 3.2.0 beta uses weak encryption ("reversible encoding") for passwords, account names, and IP addresses in kiwidb-cattools.kdb, which might allow local users to gain sensitive information by decrypting the file. NOTE: this issue could be leveraged with a directory traversal vulnerability for a remote attack vector.

References

http://osvdb.org/33163
http://secunia.com/advisories/24103
http://securityreason.com/securityalert/2236
http://www.securityfocus.com/archive/1/459500/100/0/threaded

Vulnerable Configurations

cpe:2.3:a:kiwi_enterprises:kiwi_cattools:*:*:*:*:*:*:*:*
cpe:2.3:a:kiwi_enterprises:kiwi_cattools:*:*:*:*:*:*:*:*

CVSS

Base:	4.6 (as of 16-10-2018 - 16:35)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:L/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bugtraq	20070208 TFTP directory traversal in Kiwi CatTools
osvdb	33163
secunia	24103
sreason	2236

Last major update

16-10-2018 - 16:35

Published

12-02-2007 - 23:28

Last modified

16-10-2018 - 16:35