Title: Pastel Accounting ACCUSER.DAT Obfuscation Weakness
Severity: MODERATE
Description:
Pastel Accounting is financial software for Microsoft Windows operating systems.
Pastel Accounting is reported to store sensitive user and security information on the local system using a trivially reversible obfuscation method. This information is stored in the 'ACCUSER.DAT' file in each particular client folder. 'ACCUSER.DAT' stores username/password information for individual client accounts.
The information in this file is obfuscated by rotating the characters in the original string. For example, the string "ABCDEFGH" will be stored as "stuvwxyz" in 'ACCUSER.DAT'.
Malicious users with read access to this file may easily gain access to sensitive information. This will also permit malicious users with write access to the file to modify data, since the software does not verify the contents of this file any further.
This issue was reported in Pastel Account version 6.0-6.12. Other versions may also be affected.
Affected Products:
- Pastel Pastel Accounting 6.0.0
- Pastel Pastel Accounting 6.1.0
- Pastel Pastel Accounting 6.12.0
References:
- Pastel: Pastel Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
