Description
The DICOM listener in OsiriX before 5.8 and before 2.5-MD, when starting up, encrypts the TLS private key file using "SuperSecretPassword" as the hardcoded password, which allows local users to obtain the private key.
References
- 99518 vdb-entry
- 20131106 CVE-2013-4425: Private key disclosure, Osirix (lite, 64bit and FDA cleader version) (Medical Application) mailing-list
- 63566 vdb-entry
- osirix-cve20134425-info-disc(88606) vdb-entry