CVE-2000-0572
Published Jul 5, 2000
Last updated a year ago
Overview
- Description
- The Razor configuration management tool uses weak encryption for its password file, which allows local users to gain privileges.
- Source
- cve@mitre.org
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 4.6
- Impact score
- 6.4
- Exploitability score
- 3.9
- Vector string
- AV:L/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- NVD-CWE-Other
Vendor comments
- RazorSubsequent releases of Razor address this issue and utilize a more robust encryption mechanism for the Razor password. If you are under maintenance, you have the option of upgrading to a more recent release of Razor at no cost. If you are not under maintenance and want to upgrade then you will need to contact Jennifer Stone at jstone@visible.com. Some additional notes ... - With version 4.1 and above, administrators of Razor may switch and use the local OS authentication instead of Razor’s authentication method. - OS permissions and protections always apply to the artifacts stored in the database. - This notice applies to users that have already logged into the supporting system. This primary means of defense is intact inspite of this particular vulnerability. - The next Razor release (due out in mid-2007) will allow remote UNIX clients to utilize SSH to authenticate the remote user. More information on this release and others may be found on the Visible Systems web site: http://www.visible.com/Products/Razor Please contact Visible Systems Corporation at 1-800-6-VISIBLE if you have additional questions.
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:visible_systems:razor:4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D706F22A-65ED-4893-B4B3-2594316F18B2"
}
],
"operator": "OR"
}
]
}
]