VulnerabilityModified
CVE-2015-2864
Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate password hashes, which makes it easier for remote attackers to bypass authentication and obtain access to backup…
MEDIUM 5.0EPSS 3.34%
Does this matter?
Lower severity and a low EPSS score (3.34%). Track it; it rarely justifies an emergency change on its own.
Description
Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate password hashes, which makes it easier for remote attackers to bypass authentication and obtain access to backup files by leveraging a collision.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 3.34% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-255
- Affected
- retrospect/retrospect · retrospect/retrospect client
- Source
- cret@cert.org
References
- http://www.kb.cert.org/vuls/id/101500Third Party Advisory, US Government Resource
- http://www.retrospect.com/support/kb/cve_2015_2864Patch, Vendor Advisory
- http://www.securityfocus.com/bid/75201
- http://www.securitytracker.com/id/1033948
- https://www.youtube.com/watch?v=MB8AL5u7JCAExploit
- http://www.kb.cert.org/vuls/id/101500Third Party Advisory, US Government Resource
- http://www.retrospect.com/support/kb/cve_2015_2864Patch, Vendor Advisory
- http://www.securityfocus.com/bid/75201
- http://www.securitytracker.com/id/1033948
- https://www.youtube.com/watch?v=MB8AL5u7JCAExploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.