Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2005-4448

Overview

Vulnerability Score 10.0 10.0
CVE Id CVE-2005-4448
Last Modified 05 Sep 2008 04:56:54
Published 21 Dec 2005 06:03:00
Confidentiality Impact COMPLETE COMPLETE
Integrity Impact COMPLETE COMPLETE
Availability Impact COMPLETE COMPLETE
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2005-4448

Summary

FlatNuke 2.5.6 verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext password, which allows attackers to gain privileges by obtaining the password hash (possibly via CVE-2005-2813), then calculating the credentials and including them in the secid cookie.

Vulnerable Systems

Application

  • Flatnuke 2.5.6


References

XF - flatnuke-multiple-obtain-information(22159)

BID - 15796

BUGTRAQ - 20051210 Flatnuke 2.5.6 privilege escalation / remote commands execution exploit

SECTRACK - 1015339

MISC - http://cvs.sourceforge.net/viewcvs.py/flatnuke/flatnuke/Changelog?rev=1.78&view=markup


Last Updated: 27 May 2016 10:41:18