exploit the possibilities

ISL Light Desktop 3.5.4 Information Disclosure

ISL Light Desktop 3.5.4 Information Disclosure
Posted Dec 3, 2013
Authored by Juan Francisco

ISL Light - Desktop version 3.5.4 suffers from an information disclosure vulnerability. In cases where a person is hosting a sharing session and allows a remote user to see what is happening on the local PC, it has been discovered that if you locally copy something like a hidden password to the local clipboard, then the remote user will be able to directly paste it in clear text into a notepad or other form of document, effectively gaining access to the password. It is not possible to lock this functionality.

tags | exploit, remote, local, info disclosure
advisories | CVE-2013-6237
MD5 | 3ca5cf964d7cbfa0bcebbcafe1b8ed72

ISL Light Desktop 3.5.4 Information Disclosure

Change Mirror Download
CVE-2013-6237:ISL Light - Desktop 3.5.4, Clipboard security issue


In cases where a person is hosting a sharing session and allows a remote
user to see what is happening on the local PC, it’s been discovered that if
you locally copy something like a hidden password to the local clipboard,
then the remote user will be able to directly paste it in clear text into a
notepad or other form of document, effectively gaining access to the
password. Not possible to lock this functionality.


Example,
1. You start ISLonline Console session
2. External consultant joins session using ISLonline Support
3. You copy a password into your computers copy buffer
a. E.g. from KeePass Password Manager
4. Security issue: External consultants can now paste your password
into e.g. his own Notepad as see it in clear text
a. Password is revealed
b. The other problem is that password remain in his copy buffer
after session ends
c. E.g. KeePass’s auto clean copy buffer feature does not
prevent problem


Vendor: http://www.islonline.com/

Vendor issue code: ISLLIGHT-557,
http://www.islonline.com/help/isl-releases-info/any/manual/?2013-11-29-rel-info-isl-light-desktop-plugin-1-4-7-win.htm

Affected product: ISL light 3.5.4 compiled on Sep 26 2013 revision 30035

Solved: ISL Light Desktop plugin for Windows 1.4.7 (2013-11-29)

Credit: This issue was reported by Juan Francisco Bolivar
es.linkedin.com/in/jfbolivar/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6237

J. Francisco Bolivar

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

August 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    10 Files
  • 2
    Aug 2nd
    8 Files
  • 3
    Aug 3rd
    2 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    79 Files
  • 7
    Aug 7th
    16 Files
  • 8
    Aug 8th
    10 Files
  • 9
    Aug 9th
    10 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    6 Files
  • 12
    Aug 12th
    26 Files
  • 13
    Aug 13th
    15 Files
  • 14
    Aug 14th
    19 Files
  • 15
    Aug 15th
    52 Files
  • 16
    Aug 16th
    11 Files
  • 17
    Aug 17th
    1 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close