Password Storage Vulnerability in MSN Messenger 7.5 by Microsoft

CVE-2006-0363

Summary

The 'Remember my Password' feature in MSN Messenger 7.5 retains user passwords in an encrypted format within a specific Windows registry key. This method of storing credentials can potentially allow local users to retrieve the original passwords by utilizing decryption methods available on the system, such as those implemented in the 'MSN Password Recovery.exe' utility. Given the inherent access to decryption keys and methods on local machines, the overall security of this password storage mechanism can be significantly compromised, posing a risk to user privacy.

References