CVE-2007-6340 - Geert Moernaut LSrunasE 1.0 and Supercrypt 1.0 use the RC4 stream cipher without constructing a uniq

CVE-2007-6340

Summary

Geert Moernaut LSrunasE 1.0 and Supercrypt 1.0 use the RC4 stream cipher without constructing a unique initialization vector (IV), which makes it easier for local users to obtain cleartext passwords.

References

http://securityreason.com/securityalert/3611
http://www.moernaut.com/default.aspx?item=lsrunase
http://www.moernaut.com/default.aspx?item=supercrypt
http://www.securityfocus.com/archive/1/487269/100/0/threaded

Vulnerable Configurations

cpe:2.3:a:moernaut:lsrunase:1.0:*:*:*:*:*:*:*
cpe:2.3:a:moernaut:lsrunase:1.0:*:*:*:*:*:*:*
cpe:2.3:a:moernaut:supercrypt:1.0:*:*:*:*:*:*:*
cpe:2.3:a:moernaut:supercrypt:1.0:*:*:*:*:*:*:*

CVSS

Base:	2.1 (as of 15-10-2018 - 21:52)
Impact:
Exploitability:

CWE

CWE-255

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:L/AC:L/Au:N/C:P/I:N/A:N

refmap via4

bugtraq	20080129 Insecure Use of RC4 in LSrunasE and Supercrypt (CVE-2007-6340)
confirm	http://www.moernaut.com/default.aspx?item=lsrunase http://www.moernaut.com/default.aspx?item=supercrypt
sreason	3611

Last major update

15-10-2018 - 21:52

Published

05-02-2008 - 03:00

Last modified

15-10-2018 - 21:52