CVE-2000-1008

MediumCVSS 4.6/10Last modified Sep 23, 2026

Description

PalmOS 3.5.2 and earlier uses weak encryption to store the user password, which allows attackers with physical access to the Palm device to decrypt the password and gain access to the device.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.atstake.com/research/advisories/2000/a092600-1.txtExploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/1715Exploit, Patch, Vendor Advisory
http://www.atstake.com/research/advisories/2000/a092600-1.txtExploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/1715Exploit, Patch, Vendor Advisory

Timeline

Published: Dec 11, 2000
Last modified: Sep 23, 2026
NVD status: Modified

Related CVEs from 2000

CVE-2000-10097.2dump in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to obtain root privilege CVE-2000-101010.0Format string vulnerability in talkd in OpenBSD and possibly other BSD-based OSes allows remote attackers to execute arbitrary commands via CVE-2000-10117.2Buffer overflow in catopen() function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to gain root privileges via a CVE-2000-10127.2The catopen function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environmen CVE-2000-10137.2The setlocale function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environm CVE-2000-10147.5Format string vulnerability in the search97.cgi CGI script in SCO help http server for Unixware 7 allows remote attackers to execute arbitra CVE-2000-10157.5The default configuration of Slashcode before version 2.0 Alpha has a default administrative password, which allows remote attackers to gain CVE-2000-10165.0The default configuration of Apache (httpd.conf) on SuSE 6.4 includes an alias for the /usr/doc directory, which allows remote attackers to CVE-2000-10175.0Webteachers Webdata allows remote attackers with valid Webdata accounts to read arbitrary files by posting a request to import the file into CVE-2000-10182.1shred 1.0 file wiping utility does not properly open a file for overwriting or flush its buffers, which prevents shred from properly replaci CVE-2000-10195.0Search engine in Ultraseek 3.1 and 3.1.10 (aka Inktomi Search) allows remote attackers to cause a denial of service via a malformed URL.CVE-2000-10207.5Heap overflow in Worldclient in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrar