Osirix-viewer OsiriX up to 5.7 Listener credentials management

Summaryinfo

A vulnerability classified as problematic has been found in Osirix-viewer OsiriX. Impacted is an unknown function of the component Listener. The manipulation leads to credentials management. This vulnerability is uniquely identified as CVE-2013-4425. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Osirix-viewer OsiriX (Operating System). This issue affects some unknown processing of the component Listener. The manipulation with an unknown input leads to a credentials management vulnerability. Using CWE to declare the problem leads to CWE-255. Impacted is confidentiality. The summary by CVE is:

The DICOM listener in OsiriX before 5.8 and before 2.5-MD, when starting up, encrypts the TLS private key file using "SuperSecretPassword" as the hardcoded password, which allows local users to obtain the private key.

The weakness was disclosed 11/17/2013 by Dirk-Willem van Gulik (Website). The advisory is shared at archives.neohapsis.com. The identification of this vulnerability is CVE-2013-4425 since 06/12/2013. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1552 for this issue.

Upgrading to version 1.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (88606), SecurityFocus (BID 63566†) and OSVDB (99518†). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Osirix-viewer

Name

• OsiriX

Version

• 0.2
• 1.0
• 1.1
• 1.1.2
• 1.3
• 1.4
• 1.5
• 1.5.1
• 1.5.2
• 1.6
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.7
• 1.7.1
• 2.0
• 2.1
• 2.2
• 2.3
• 2.3.1
• 2.4
• 2.5
• 2.6
• 2.7.5
• 3.0
• 3.2.1
• 3.3
• 3.5
• 3.6
• 3.7.1
• 3.8.1
• 3.9.4
• 4.0
• 4.1.2
• 5.0.2
• 5.5.2
• 5.6
• 5.7

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion