Telecommunication Software SAMwin Contact Center Suite 5.1 Password SAMwinLIBVB.dll passwordScramble svag autentisering

I Telecommunication Software SAMwin Contact Center Suite 5.1 har en kritisksvag punkt upptäckte. Som påverkar funktionen passwordScramble hos två bibliotek SAMwinLIBVB.dll av komponenten Password Handler. Manipulering en okänd ingång leder till en sårbarhet klass svag autentisering svag punkt. Den rådgivande finns tillgänglig för nedladdning på modzero.ch. Publikationen gjordes i samarbete med tillverkaren. Denna svaga punkt behandlas som CVE-2013-10004. Attacken på nätet kan. Det finns tekniska detaljer känd. Han deklarerade inte definierad. Minst 174 dagar var den svaga punkten som 0-day. En uppgradering till den version 6.2 att åtgärda problemet. Som bläst uppdatera till den senaste versionen åtgärder rekommenderas. En möjlig åtgärd har utfärdats före och inte bara efter offentliggörandet.

Fält03/04/2014 17:2131/03/2019 21:5824/05/2022 15:15
cvss3_vuldb_rlOOO
cvss3_vuldb_rcRRR
0day_days174174174
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_prNNN
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aNNN
vendorTelecommunication SoftwareTelecommunication SoftwareTelecommunication Software
nameSAMwin Contact Center SuiteSAMwin Contact Center SuiteSAMwin Contact Center Suite
version5.15.15.1
componentPassword HandlerPassword HandlerPassword Handler
librarySAMwinLIBVB.dllSAMwinLIBVB.dllSAMwinLIBVB.dll
functionpasswordScramblepasswordScramblepasswordScramble
affectedlistTelecommunication Software SAMwin Contact Center Suite 5.1 Telecommunication Software SAMwin Agent 5.01.19.06Telecommunication Software SAMwin Contact Center Suite 5.1 Telecommunication Software SAMwin Agent 5.01.19.06Telecommunication Software SAMwin Contact Center Suite 5.1 Telecommunication Software SAMwin Agent 5.01.19.06
vendorinformdate137963520013796352001379635200
risk111
historic000
cvss2_vuldb_basescore5.85.85.8
cvss2_vuldb_tempscore4.84.84.8
cvss2_vuldb_avNNN
cvss2_vuldb_acMMM
cvss2_vuldb_auNNN
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiNNN
cvss3_meta_basescore6.56.56.5
cvss3_meta_tempscore6.06.06.0
cvss3_vuldb_basescore6.56.56.5
cvss3_vuldb_tempscore6.06.06.0
sourcecodevoid function passwordScramble n = strlen(pwd) pwd = toupper(pwd) hashsum = 0 for (i = 0; i < n; i++) { hashsum += (i+1) * pwd[i]; } return hashsumvoid function passwordScramble n = strlen(pwd) pwd = toupper(pwd) hashsum = 0 for (i = 0; i < n; i++) { hashsum += (i+1) * pwd[i]; } return hashsumvoid function passwordScramble n = strlen(pwd) pwd = toupper(pwd) hashsum = 0 for (i = 0; i < n; i++) { hashsum += (i+1) * pwd[i]; } return hashsum
advisoryquoteThe probability that a certain hash value occurs is highly non-uniform (...) It roughly resembles a slightly skewed normal distribution centered around 3700 with a standard deviation of about 450. 90% of all possible password inputs will result in hash values between 3000 and 4500. The odds that a randomly chosen password from the 5.44 * 10^19 possible values will have the exact hash value 3700 is about 1:1138. An attacker is able to exploit this statistical property to speed up a brute-force attack: he constructs a list of password candidates with exactly one password for every possible hash value. Optimally, he guesses candidates from this list in order of descending probability.The probability that a certain hash value occurs is highly non-uniform (...) It roughly resembles a slightly skewed normal distribution centered around 3700 with a standard deviation of about 450. 90% of all possible password inputs will result in hash values between 3000 and 4500. The odds that a randomly chosen password from the 5.44 * 10^19 possible values will have the exact hash value 3700 is about 1:1138. An attacker is able to exploit this statistical property to speed up a brute-force attack: he constructs a list of password candidates with exactly one password for every possible hash value. Optimally, he guesses candidates from this list in order of descending probability.The probability that a certain hash value occurs is highly non-uniform (...) It roughly resembles a slightly skewed normal distribution centered around 3700 with a standard deviation of about 450. 90% of all possible password inputs will result in hash values between 3000 and 4500. The odds that a randomly chosen password from the 5.44 * 10^19 possible values will have the exact hash value 3700 is about 1:1138. An attacker is able to exploit this statistical property to speed up a brute-force attack: he constructs a list of password candidates with exactly one password for every possible hash value. Optimally, he guesses candidates from this list in order of descending probability.
date1394668800 (13/03/2014)1394668800 (13/03/2014)1394668800 (13/03/2014)
locationWebsiteWebsiteWebsite
typeAdvisoryAdvisoryAdvisory
urlhttp://www.modzero.ch/advisories/MZ-13-07_SAMwin_Collisions.txthttp://www.modzero.ch/advisories/MZ-13-07_SAMwin_Collisions.txthttp://www.modzero.ch/advisories/MZ-13-07_SAMwin_Collisions.txt
identifierMZ-13-07MZ-13-07MZ-13-07
coordination111
person_nameTobias Ospelt/Max MoserTobias Ospelt/Max MoserTobias Ospelt/Max Moser
company_namemodzero AGmodzero AGmodzero AG
confirm_date1379980800 (24/09/2013)1379980800 (24/09/2013)1379980800 (24/09/2013)
price_0day$0-$5k$0-$5k$0-$5k
nameUpgradeUpgradeUpgrade
upgrade_version6.26.26.2
advisoryquoteIt is recommended to limit the number of possible password tries for all accounts. The vendor will not provide any fixes for previous versions.It is recommended to limit the number of possible password tries for all accounts. The vendor will not provide any fixes for previous versions.It is recommended to limit the number of possible password tries for all accounts. The vendor will not provide any fixes for previous versions.
seealso12789 1278812789 1278812789 12788
cvss2_vuldb_eNDNDND
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_rcURURUR
cvss3_vuldb_eXXX
cwe0287 (svag autentisering)287 (svag autentisering)
cveCVE-2013-10004
responsibleVulDB

◂ TidigareÖversiktNästa ▸

Do you need the next level of professionalism?

Upgrade your account now!