Description
Microsoft ActiveSync 4.1, as used in Windows Mobile 5.0, uses weak encryption (XOR obfuscation with a fixed key) when sending the user's PIN/Password over the USB connection from the host to the device, which might make it easier for attackers to decode a PIN/Password obtained by (1) sniffing or (2) spoofing the docking process.
References
- 38499 vdb-entry
- 25976 vdb-entry
- microsoft-activesync-weak-encryption(37223) vdb-entry
- 20071015 SYMSA-2007-010: Microsoft ActiveSync 4.x Weak Password Obfuscation mailing-list
- 3232 third-party-advisory