CoreCVE
Back

HIGH

The login_to_simulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login mechanisms, sends an MD5 hash in cleartext in the passwd field, which allows remote attackers to login to an account by sniffing the network and then sending this hash to a Second Life authentication server

Published Sep 18, 2007

Description

The login_to_simulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login mechanisms, sends an MD5 hash in cleartext in the passwd field, which allows remote attackers to login to an account by sniffing the network and then sending this hash to a Second Life authentication server.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-311

Missing Encryption of Sensitive Data

References (2)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Sep 18, 2007
Updated Aug 7, 2024
Reserved Sep 18, 2007
Link CVE-2007-4961
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 16, 2026
Link CVE-2007-4961
Red Hat
Severity n/a
Public date n/a
Links CVE-2007-4961