Secunia

A weakness has been reported in Meridian Prolog Manager, which can be exploited by malicious people to brute force user passwords.

The weakness is caused due to the server transmitting an encrypted dataset of all usernames and passwords to a client during login, using a weak encryption. This can be exploited to disclose usernames and passwords on the network via brute force attacks.

The complexity of the brute force attacks reportedly depends on which encryption setting was chosen ("No Encryption", "Standard Encryption", "Enhanced Encryption").

The weakness is reported in Prolog Manager versions 2007 and 7.5. Other versions may also be affected.

Solution
Use in a trusted network environment only and use the "Enhanced Encryption" option.

Provided and/or discovered by
An anonymous person ("Prolog Error").

Original Advisory
http://archives.neohapsis.com/archives/bugtraq/2007-12/0150.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area