Products

UCI IDOL 2

• 2.0

• 2.1

• 2.11

• 2.12

Source

cve@mitre.org

Published : Aug. 22, 2024, 4:15 a.m.
Last Modified : Aug. 22, 2024, 12:48 p.m.

Description

An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is sent between client and server with encryption. However, the key is derived from the string "(c)2007 UCI Software GmbH B.Boll" (without quotes). The key is both static and hardcoded. With access to messages, this results in message decryption and encryption by an attacker. Thus, it enables passive and active man-in-the-middle attacks.

References

URL	Source
http://download.uci.de/idol2/idol2Client_2_12.exe	cve@mitre.org
https://uci.de/download/idol2-client.html	cve@mitre.org
https://uci.de/products/index.html	cve@mitre.org
https://www.syss.de/en/responsible-disclosure-policy	cve@mitre.org
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-048.txt	cve@mitre.org