search menu icon-carat-right cmu-wordmark

CERT Coordination Center

CollabNet ScrumWorks Basic Server transmits credential information in plaintext

Vulnerability Note VU#547167

Original Release Date: 2011-01-21 | Last Revised: 2011-01-21

Overview

Communication between the Collabnet ScrumWorks Basic Server and CollabNet ScrumWorks Desktop Client transmits credential information in plaintext.

Description

The communication between the CollabNet ScrumWorks Basic Server and CollabNet ScrumWorks Desktop Client is transmitting credential information in plaintext. The CollabNet ScrumWorks Basic Server communicates with the CollabNet ScrumWorks Desktop Client using unencrypted java objects. These unencrypted java objects contain the username and password of the active user or (by calling specific functions) all users on the CollabNet ScrumWorks Basic Server.

An additional vulnerability exists in CollabNet ScrumWorks where the ScrumWorks Basic Server stores unencrypted client username and passwords in its internal database.

Impact

An attacker could view the credentials of the active client or all of the authenticated client's username and password hashs using a packet capturing tool.

Solution

CollabNet has stated to CERT that the client passwords are encrypted in CollabNet ScrumWorks Pro, and there are no plans for adding an encryption feature into CollabNet ScrumWorks Basic. CollabNet ScrumWorks Basic should not be used for sensitive data.

Restrict access

Restrict network access to the CollabNet ScrumWorks and other devices using open protocols like HTTP.

Vendor Information

547167
 
Affected   Unknown   Unaffected

CollabNet

Notified:  December 20, 2010 Updated:  January 17, 2011

Status

  Affected

Vendor Statement

CollabNet has stated to CERT that the client passwords are encrypted in CollabNet ScrumWorks Pro, and there are no plans for adding an encryption feature into CollabNet ScrumWorks Basic.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Acknowledgements

Thanks to David Elze from Daimler TSS Technical Security for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs: CVE-2011-0410
Severity Metric: 14.40
Date Public: 2011-01-21
Date First Published: 2011-01-21
Date Last Updated: 2011-01-21 15:05 UTC
Document Revision: 21

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.