CVE-2002-1975

Sharp Zaurus PDA SL-5000D and SL-5500 uses a salt of "A0" to encrypt the screen-locking password as stored in the Security.conf file, which makes it easier for local users to guess the password via brute force methods.

CVSS v3 5.5 MEDIUM
CVSS v2.0 2.1 LOW

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://online.securityfocus.com/archive/1/281437	Broken Link Third Party Advisory VDB Entry
http://www.iss.net/security_center/static/9535.php	Broken Link
http://www.securityfocus.com/bid/5201	Broken Link Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:sharp:zaurus_sl-5000d_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:sharp:zaurus_sl-5000d:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:sharp:zaurus_sl-5500_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:sharp:zaurus_sl-5500:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2002-12-31 05:00

Updated : 2024-02-14 15:50

NVD link : CVE-2002-1975

Mitre link : CVE-2002-1975

CVE.ORG link : CVE-2002-1975

JSON object : View

Products Affected

sharp

zaurus_sl-5500
zaurus_sl-5500_firmware
zaurus_sl-5000d
zaurus_sl-5000d_firmware

CWE

CWE-326

Inadequate Encryption Strength

{"id": "CVE-2002-1975", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2002-12-31T05:00:00.000", "references": [{"url": "http://online.securityfocus.com/archive/1/281437", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.iss.net/security_center/static/9535.php", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/5201", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-326"}]}], "descriptions": [{"lang": "en", "value": "Sharp Zaurus PDA SL-5000D and SL-5500 uses a salt of \"A0\" to encrypt the screen-locking password as stored in the Security.conf file, which makes it easier for local users to guess the password via brute force methods."}], "lastModified": "2024-02-14T15:50:35.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sharp:zaurus_sl-5000d_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D77A45A8-14DE-4AB0-8E2B-01F3D2F24D04"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sharp:zaurus_sl-5000d:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DDCC07C5-0633-49E0-B168-05CA8A72CE5A"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sharp:zaurus_sl-5500_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76E071CE-EDDA-46F6-97D0-AF49FC1AABC7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sharp:zaurus_sl-5500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "304BBA12-4A60-4F10-8743-C6E05ECFBF03"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}