OSVDB ID: 3491 Title: SurfControl SuperScout Web Filter Weak Encryption |
Info |
|
|
Dates |
||||
|
|
Description |
SurfControl web filters contain a flaw that allows a remote attacker to trivially obtain and decrypt passwords. The issue is due to the JavaScript program used to encrypt passwords using a "text string" and "key", which is hard coded into a JavaScript function and trivial to decrypt (The key is "test"). With this information, an attacker can access any reports available on the server. |
Classification |
Unknown or Incomplete |
Solution |
Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workarounds: Disable the reports server and consider using a terminal session to the server to access the reports. |
Products |
|
References |
|
Credit |
Unknown or Incomplete |