A vulnerability, which was classified as problematic, has been found in PasswordSafe 3.0. Affected by this issue is the function rand. The manipulation with an unknown input leads to a missing encryption vulnerability. Using CWE to declare the problem leads to CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. Impacted is confidentiality. CVE summarizes:

PasswordSafe 3.0 beta, when running on Windows before XP, uses a weak random number generator (C++ rand function) during generation of the database encryption key, which makes it easier for attackers to decrypt the database and steal passwords by generating keys for all possible rand() seed values and conducting a known plaintext attack.

The weakness was shared 03/23/2006 with Elcomsoft (Website). The advisory is shared for download at securityfocus.com. This vulnerability is handled as CVE-2006-1378 since 03/23/2006. The exploitation is known to be easy. The attack needs to be approached locally. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1600.

The vulnerability is also documented in the vulnerability database at X-Force (25429). The entries VDB-6, VDB-17654, VDB-152435 and VDB-170717 are related to this item.

Productinfo

Name

• PasswordSafe

Version

• 3.0

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion