Weak Ignite Realtime Spark password encryption Vulnerability

Release date:
Updated on: 2012-08-01

Affected Systems:
Ignite Realtime Spark
Description:
--------------------------------------------------------------------------------
Bugtraq id: 54736

Ignite Realtime Spark is an open-source cross-platform IM client.

Ignite Realtime Spark 2.6.3 and other versions have a weak password encryption vulnerability, which allows attackers to decrypt stored passwords.

<* Source: Adam Caudill
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Ignite Realtime
---------------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.igniterealtime.org/downloads/index.jsp#openfire