CVE-2020-8968 : Security Advisory and Response
Learn about CVE-2020-8968, a high-severity vulnerability in Parallels Remote Application Server that allows local attackers to retrieve profile passwords, compromising user data security. Find mitigation steps and preventive measures here.
Parallels Remote Application Server (RAS) allows a local attacker to retrieve certain profile passwords in clear text format, posing a risk to user information security.
Understanding CVE-2020-8968
This CVE involves a vulnerability in Parallels Remote Application Server that could compromise user profile passwords.
What is CVE-2020-8968?
Parallels RAS is susceptible to a flaw that enables a local attacker to access specific profile passwords in plain text by uploading a previously encrypted file. This could lead to a breach of user data confidentiality, availability, and integrity.
The Impact of CVE-2020-8968
The vulnerability has a high severity level, with a CVSS base score of 7.1. It can result in compromised confidentiality and integrity of user information.
Technical Details of CVE-2020-8968
This section provides more in-depth technical insights into the CVE.
Vulnerability Description
The flaw in Parallels RAS allows local attackers to retrieve profile passwords in clear text by uploading encrypted files, potentially compromising user data.
Affected Systems and Versions
- Product: Parallels Remote Application Server (Client)
- Vendor: Parallels
- Versions Affected: 15.5 to 17
Exploitation Mechanism
The vulnerability can be exploited locally by uploading a previously encrypted file, leading to the retrieval of profile passwords.
Mitigation and Prevention
Protecting systems from CVE-2020-8968 is crucial to maintaining data security.
Immediate Steps to Take
- Monitor for security advisories from Parallels regarding patches and fixes.
- Implement access controls to limit exposure to potential attackers.
- Educate users on secure password management practices.
Long-Term Security Practices
- Regularly update Parallels RAS to the latest version to address known vulnerabilities.
- Conduct security assessments and penetration testing to identify and remediate weaknesses.
Patching and Updates
Parallels periodically releases fixes and patches for vulnerabilities like the one described in CVE-2020-8968.