The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Password Safe - Lock Password Database Configuration Not Enforced
------------------------------------------------------------------------
SUMMARY
<http://passwordsafe.sourceforge.net/> Password Safe is "open source
software which allows users to create a secured and encrypted master
password list. This list is controlled and accessed through the Password
Safe software resident on a user s workstation". One of the security
features of the software allows users to configure the password database
to lock upon the workstation being locked or after a set period of
inactivity. It was determined that this locking feature is not enforced on
either of these events when certain dialog windows are open in the
software.
DETAILS
Vulnerable Systems:
* Password Safe version 2.11
* Password Safe version 2.16
* Password Safe version 3.0BETA1
Immune Systems:
* Password Safe version 3.01
Password Safe can be configured to lock the password database when the
workstation is locked or after a set period of idle time to prevent
unauthorized access to the database contents. When the following dialogue
windows are left open in the application the database will not lock on
either of these preconfigured events.
File > New Database
File > Open Database
File > Save As
File > Export To
File > Import From
File > Merge Database
Edit > Add Entry
Edit > Edit/View Entry
Manage > Change Safe Combination
Manage > Make Backup
Manage > Restore from Backup
Help > About Password Safe
By not locking the password database as configured, its contents may be at
risk of compromise by an attacker with access to the workstation.
Vendor Response:
The above vulnerability was addressed for the affected platforms in
Password Safe 3.01.
Customers can download the latest version of Password Safe from the
following website: <https://sourceforge.net/projects/passwordsafe/>
https://sourceforge.net/projects/passwordsafe/
If there are any further questions about this statement, please contact
ronys AT users.sourceforge DOT net.
Recommendation:
Follow your organization's testing procedures before applying patches or
workarounds. Customers should upgrade to Password Safe 3.01, or higher as
soon as possible.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3675>
CVE-2006-3675
ADDITIONAL INFORMATION
The information has been provided by Symantec.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
