CVE-2003-1447: Weak Password Protection in WebSphere 4.0.4 XML Config Export

Critical Vulnerability Information Vulnerability Overview Vulnerability Name: Weak Password Protection in WebSphere 4.0.4 XML Configuration Export CVE ID: CVE-2003-1447 Risk Level: Medium CVSS Score: 1.9/10 Vulnerability Details Description: Password protection in exported WebSphere XML configurations is insufficient. If the exported configuration falls into the hands of a malicious user, they can easily de-obfuscate passwords and gain access to password-protected resources. Affected Versions: - WebServer Advanced Server 4.0.4 - Other versions may also be affected Unaffected Versions: - Unknown Impact and Risk CVSS Score Breakdown: - Base Score: 1.9/10 - Impact Subscore: 2.9/10 - Confidentiality Impact: Partial - Integrity Impact: None - Availability Impact: None - Exploitability Subscore: 3.4/10 - Attack Complexity: Medium - Authentication: None Required Solutions and Mitigation Risk Mitigation Measures: Administrators should ensure that exported configurations are saved in directories accessible only to administrators, and exported files should be deleted after use. Vulnerability Details: Exported configurations include password materials required for access keys and data sources. These passwords are obfuscated and Base64-encoded. - Obfuscation Algorithm: - CASRofucated(n) = CHAR(password(n) XOR CHAR('_')) - ObfuscatedPasswordBase64Encoded = Base64Encode(ObfuscatedPassword) - De-obfuscation Process: - ObfuscatedPassword = Base64Decode(ObfuscatedPasswordBase64Encoded) - CHARpassword(n) = CHARofucated(n) XOR CHAR('_') Reference Information Release Date: 2007.10.23 Author: Jan P. Monsch Website: http://www.csnc.ch/

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2003-1447: Weak Password Protection in WebSphere 4.0.4 XML Config Export