CVE-2007-3201

Visual truncation vulnerability in Windows Privacy Tray (WinPT) 1.2.0 allows user-assisted remote attackers to install a key listed under the wrong user ID, and possibly cause the user to encrypt a victim's correspondence with this attacker-supplied key, via a key ID composed of the attacker's user ID, space characters, an invalid WinPT message, additional space characters, and the victim's user ID.

CVSS v2.0 7.1 HIGH

7.1^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:N/I:C/A:N

Exploitability : 8.6 / Impact : 6.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact COMPLETE

Availability Impact NONE

References

Link	Resource
http://osvdb.org/41727
http://securityreason.com/securityalert/2791
http://wald.intevation.org/tracker/index.php?func=detail&aid=327&group_id=14&atid=138
http://www.securityfocus.com/archive/1/471045/100/0/threaded
http://www.securityfocus.com/bid/24412	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/34813

Configurations

Configuration 1 (hide)

cpe:2.3:a:winpt:winpt:1.2.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2007-06-12 23:30

Updated : 2018-10-16 16:47

NVD link : CVE-2007-3201

Mitre link : CVE-2007-3201

CVE.ORG link : CVE-2007-3201

JSON object : View

Products Affected

winpt

winpt

CWE

NVD-CWE-Other

{"id": "CVE-2007-3201", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:C/A:N", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2007-06-12T23:30:00.000", "references": [{"url": "http://osvdb.org/41727", "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/2791", "source": "cve@mitre.org"}, {"url": "http://wald.intevation.org/tracker/index.php?func=detail&aid=327&group_id=14&atid=138", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/471045/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/24412", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34813", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Visual truncation vulnerability in Windows Privacy Tray (WinPT) 1.2.0 allows user-assisted remote attackers to install a key listed under the wrong user ID, and possibly cause the user to encrypt a victim's correspondence with this attacker-supplied key, via a key ID composed of the attacker's user ID, space characters, an invalid WinPT message, additional space characters, and the victim's user ID."}, {"lang": "es", "value": "Vulnerabilidad de truncamiento visual en Windows Privacy Tray (WinPT) 1.2.0 permite a atacantes remotos con la intervenci\u00f3n del usuario instalar una clave listada bajo un ID de usuario incorrecto, y posiblemente provocar que el usuario encripte la correspondencia de la victima con la clave suministrada por el atacante, mediante una clave ID compuesta por el ID del usuario atacante, caracteres de espacio, un mensaje WinPT invalido, caracteres de espacio adicionales y el ID del usuario victima."}], "lastModified": "2018-10-16T16:47:52.607", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:winpt:winpt:1.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EBF6C00C-0039-40C1-9876-CA7ABE86ACDA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}