Description
Comvigo IM Lock 2006 uses a simple substitution cipher to encrypt a password stored in the msnvs\prc registry value, for which all users have Read permission, which allows local users to bypass the product's blocking functionality by decrypting the password.
References
- 16988 vdb-entry
- 19140 third-party-advisory
- 20060306 IM Lock 2006 - Insecure Registry Permission Vulnerability mailing-list
- imlock-password-weak-encryption(25219) vdb-entry
- ADV-2006-0866 vdb-entry