CVE-2000-0955: Weak Encryption

Q: What does an attacker need to exploit this issue?

An attacker needs to know the SNMP community name. With that information, they can obtain weakly encrypted usernames and passwords from the SNMP MIB and crack the password.

Q: What access could an attacker gain after cracking the stored password?

The available information states that cracking the password can allow the attacker to gain privileges. The specific privilege level is not provided.

Q: Is a fix available?

Yes. A patch is available for this issue.

Published Nov 29, 2000

Updated

Cisco Virtual Central Office 4000 (VCO/4K) uses weak encryption to store usernames and passwords in the SNMP MIB, which allows an attacker who knows the community name to crack the password and gain privileges.

Affected Software

1 affected component

Cisco Virtual Central Office 4000<=5.1.3

Remediation

Patch Available

http://www.atstake.com/research/advisories/2000/a102600-1.txt

Patch Available

http://www.securityfocus.com/bid/1885

Event History

Nov 29, 2000

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Dec 19, 2000

Data Sourced

via NVD·05:00 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to know the SNMP community name. With that information, they can obtain weakly encrypted usernames and passwords from the SNMP MIB and crack the password.

What access could an attacker gain after cracking the stored password?

The available information states that cracking the password can allow the attacker to gain privileges. The specific privilege level is not provided.

Is a fix available?

Yes. A patch is available for this issue.

CVE-2000-0955: Weak Encryption

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What access could an attacker gain after cracking the stored password?

Is a fix available?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What access could an attacker gain after cracking the stored password?

Is a fix available?