| Vulnerability Name: | CVE-2005-2696 (CCN-21556) | ||||||||
| Assigned: | 2005-07-28 | ||||||||
| Published: | 2005-07-28 | ||||||||
| Updated: | 2016-10-18 | ||||||||
| Summary: | IBM Lotus Notes does not properly restrict access to password hashes in the Notes Address Book (NAB), which allows remote attackers to obtain sensitive information via the (1) password digest field in the Administration tab of a Lotus Notes client, (2) "PasswordDigest" and "HTTPPassword" fields in the document properties in the NAB, or (3) a direct query to the Domino LDAP server, a different vulnerability than CVE-2005-2428. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
| ||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N) 3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||
| References: | Source: CCN Type: BugTraq Mailing List, Tue Jul 26 2005 - 13:36:29 CDT Default Configuration Information Disclosure in Lotus Domino Source: MITRE Type: CNA CVE-2005-2428 Source: MITRE Type: CNA CVE-2005-2696 Source: BUGTRAQ Type: UNKNOWN 20050820 IBM Lotus Notes multiple disclosures of password hashes Source: CCN Type: SA16231 Lotus Domino Webmail Information Disclosure Security Issue Source: CCN Type: SECTRACK ID: 1014584 IBM Lotus Domino Discloses Hashed Passwords and Other Information to Remote Authenticated Users Source: CCN Type: IBM - CYYSEC Advisory Default Configuration Information Disclosure in Lotus Domino Source: CCN Type: CYBSEC Security Advisory Default Configuration Information Disclosure in Lotus Domino Source: CCN Type: IBM Web site IBM Lotus Domino Source: CCN Type: OSVDB ID: 18462 IBM Lotus Domino HTML Hidden Field Encrypted Password Disclosure Source: CCN Type: OSVDB ID: 19807 IBM Lotus Notes Client Administration Tab Password Hash Disclosure Source: CCN Type: OSVDB ID: 19808 IBM Lotus Notes Address Book (NAB) Document Properties Hashed Password Disclosure Source: CCN Type: OSVDB ID: 19809 IBM Lotus Notes Domino LDAP Server Direct Query Hashed Password Disclosure Source: CCN Type: OSVDB ID: 35764 IBM Lotus Domino / WebMail names.nsf User HTTPPassword Hashes Disclosure Source: CCN Type: OSVDB ID: 38993 IBM Lotus Notes notes.ini Debug Variables Remote Cleartext Password Disclosure Source: CCN Type: BID-14388 IBM Lotus Domino WebMail Information Disclosure Vulnerability Source: CCN Type: BID-14389 IBM Lotus Domino Password Encryption Weakness Source: MISC Type: Exploit, Vendor Advisory http://www.venera.com/downloads/Lotus_password_disclosures.pdf Source: XF Type: UNKNOWN lotus-domino-names-obtain-information(21556) Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [02-25-2016] | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||