CVE-2006-4537

OpenVMS ALPHA 7.3-2 and 8.2 - Password Exposure in NET$SESSION_CONTROL.EXE Audit Log

Title source: llm
STIX 2.1

Description

NET$SESSION_CONTROL.EXE in DECnet-Plus in OpenVMS ALPHA 7.3-2 and Alpha 8.2 writes a password to an audit log file when there is a successful connection after a "network breakin" event, which allows local users to obtain passwords by reading the file.

References (10)

Core 10
Core References
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/19783
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/28695
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/3423
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1017472
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/28272
Patch, Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21705
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23632
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1016772

Scores

EPSS 0.0062
EPSS Percentile 45.6%

Details

CWE
CWE-200
Status published
Products (2)
dec/dec_openvms_alpha 7.3.2
dec/dec_openvms_alpha 8.2
Published Sep 05, 2006
Tracked Since Feb 18, 2026