The login_to_simulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login mechanisms, sends an MD5 hash in cleartext in the passwd field, which allows remote attackers to login to an account by sniffing the network and then sending this hash to a Second Life authentication server.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.00364
Percentile: 0.57703

CVSS Scoring

Mapped CWE(s)

• CWE-311 : Missing Encryption of Sensitive Data

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1040 : Network Sniffing
  Kill Chain: credential-access
• T1111 : Multi-Factor Authentication Interception
  Kill Chain: credential-access
• T1005 : Data from Local System
  Kill Chain: collection
• T1539 : Steal Web Session Cookie
  Kill Chain: credential-access
• T1005 : Data from Local System
  Kill Chain: collection
• T1552.004 : Private Keys
  Kill Chain: credential-access
• T1056.004 : Credential API Hooking
  Kill Chain: collection
• T1111 : Multi-Factor Authentication Interception
  Kill Chain: credential-access
• T1040 : Network Sniffing
  Kill Chain: credential-access

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:lindenlab:second_life:-:*:*:*:*:*:*:*

← Back to Home