CVE-2006-0363 (CNNVD-200601-278)
中文标题:
MSN Messenger CryptUnprotectData程序原始密码获取漏洞
英文标题:
The "Remember my Password" feature in MSN Messenger 7.5 stores passwords in an encrypted format unde...
漏洞描述
中文描述:
MSN Messenger 7.5中的"记住我的密码"功能，将密码以加密格式存储在HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds注册表键中，这可能让本地用户通过调用CryptUnprotectData的程序获取原始密码，如"MSN Password Recovery.exe"程序所示。注意：可能有争议称，仅本地密码恢复是固有的不安全问题，因为解密方法和密钥必须存储在本地系统上的某个位置中，所以原本就是通过不同程度的努力即可访问这些数据的。可能此问题不应包含在CVE中。
英文描述:
The "Remember my Password" feature in MSN Messenger 7.5 stores passwords in an encrypted format under the HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds registry key, which might allow local users to obtain the original passwords via a program that calls CryptUnprotectData, as demonstrated by the "MSN Password Recovery.exe" program. NOTE: it could be argued that local-only password recovery is inherently insecure because the decryption methods and keys must be stored somewhere on the local system, and are thus inherently accessible with varying degrees of effort. Perhaps this issue should not be included in CVE.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| microsoft | msn_messenger | 7.5 | - | - |
cpe:2.3:a:microsoft:msn_messenger:7.5:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
AV:L/AC:L/Au:N/C:P/I:N/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2006-0363 |
2025-11-11 15:17:39 | 2025-11-11 07:32:31 |
| NVD | nvd_CVE-2006-0363 |
2025-11-11 14:51:47 | 2025-11-11 07:41:17 |
| CNNVD | cnnvd_CNNVD-200601-278 |
2025-11-11 15:08:49 | 2025-11-11 07:49:04 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-200601-278
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- severity: SeverityLevel.MEDIUM -> SeverityLevel.LOW
- cvss_score: 未提取 -> 2.1
- cvss_vector: NOT_EXTRACTED -> AV:L/AC:L/Au:N/C:P/I:N/A:N
- cvss_version: NOT_EXTRACTED -> 2.0
- affected_products_count: 0 -> 1
- data_sources: ['cve'] -> ['cve', 'nvd']