[BUG] Important Security Bug

[is2gu]

We just discovered a huge security hole today with visionapp 2010 R2.

We have public credentials that we have restricted access to certain user-defined roles. A user without access can not see these restricted credentials under the credentials folder in visionapp. However, if they right click on a connection and choose "Connect as" they are able to use any public credential.

This needs fixed ASAP!

[is2gu]

Have you been able to confirm this bug?

[DevOma]

Yes, I can confirm this

[is2gu]

Since this completely renders the security useless will you issue a patch immediately to correct this issue?

[TCH]

Hi,

Currently we are thinknig about the best way to provide a solution for that.

[is2gu]

Any word on when this will be fixed?

[TCH]

Hi,

Most likely by end of next week or beginning of the one after.

[is2gu]

To be honest; this is a bug of such importance that a notification should be sent out to the user base alerting them of the potential problem. This product is not in beta anymore and should be treated like such.

[TCH]

Hi,

I just created both a thread in our knowledge base and one here in the forum.
Please have a look:
http://forum.visionapp.de/showthread.php?tid=4178