Vulnerability in Osirix-Viewer Osirix

CVE-2013-4425

The DICOM listener in OsiriX before 5.8 and before 2.5-MD, when starting up, encrypts the TLS private key file using "SuperSecretPassword" as the hardcoded password, which allows local users to obtain the private key.

EPSS: 0.004 (27.6th percentile) — read the EPSS interpretation.

Affected products

Osirix-viewer Osirix — versions 0.2, 1.0, 1.1
Osirix-viewer Osirix_md
N/a — versions n/a

Weakness classification (CWE)

CWE-255

References

secalert@redhat.com (x_refsource_OSVDB, vdb-entry)
secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ)
secalert@redhat.com (vdb-entry, x_refsource_BID)
secalert@redhat.com (vdb-entry, x_refsource_XF)