accept no compromises

ISL Light Desktop 3.5.4 Information Disclosure

ISL Light Desktop 3.5.4 Information Disclosure
Posted Dec 3, 2013
Authored by Juan Francisco

ISL Light - Desktop version 3.5.4 suffers from an information disclosure vulnerability. In cases where a person is hosting a sharing session and allows a remote user to see what is happening on the local PC, it has been discovered that if you locally copy something like a hidden password to the local clipboard, then the remote user will be able to directly paste it in clear text into a notepad or other form of document, effectively gaining access to the password. It is not possible to lock this functionality.

tags | exploit, remote, local, info disclosure
advisories | CVE-2013-6237
MD5 | 3ca5cf964d7cbfa0bcebbcafe1b8ed72

ISL Light Desktop 3.5.4 Information Disclosure

Change Mirror Download
CVE-2013-6237:ISL Light - Desktop 3.5.4, Clipboard security issue


In cases where a person is hosting a sharing session and allows a remote
user to see what is happening on the local PC, it’s been discovered that if
you locally copy something like a hidden password to the local clipboard,
then the remote user will be able to directly paste it in clear text into a
notepad or other form of document, effectively gaining access to the
password. Not possible to lock this functionality.


Example,
1. You start ISLonline Console session
2. External consultant joins session using ISLonline Support
3. You copy a password into your computers copy buffer
a. E.g. from KeePass Password Manager
4. Security issue: External consultants can now paste your password
into e.g. his own Notepad as see it in clear text
a. Password is revealed
b. The other problem is that password remain in his copy buffer
after session ends
c. E.g. KeePass’s auto clean copy buffer feature does not
prevent problem


Vendor: http://www.islonline.com/

Vendor issue code: ISLLIGHT-557,
http://www.islonline.com/help/isl-releases-info/any/manual/?2013-11-29-rel-info-isl-light-desktop-plugin-1-4-7-win.htm

Affected product: ISL light 3.5.4 compiled on Sep 26 2013 revision 30035

Solved: ISL Light Desktop plugin for Windows 1.4.7 (2013-11-29)

Credit: This issue was reported by Juan Francisco Bolivar
es.linkedin.com/in/jfbolivar/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6237

J. Francisco Bolivar

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    2 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close