SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   DameWare Vendors:   DameWare Development LLC
Dameware Mini Remote Control Sends a File Encryption Key as Clear Text
SecurityTracker Alert ID:  1009557
SecurityTracker URL:  http://securitytracker.com/id/1009557
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Mar 26 2004
Impact:   Disclosure of authentication information, Disclosure of system information, Disclosure of user information
Exploit Included:  Yes  
Version(s): 4.1.0.0
Description:   A vulnerability was reported in Dameware Mini Remote Control. The software transmits an encryption key over the network in clear text.

It is reported that the software sends a Blowfish encryption key over the network without encryption. The 2nd to last string of 16 bytes prior to the file being transferred is reportedly the file encryption key.

It is also reported that the software uses an insufficiently random generator to create the encryption key, facilitating key cracking attacks.

Impact:   A remote user monitoring the network between the two encryption endpoints can determine the encryption key and gain access to the transmitted file.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.dameware.com/products/ (Links to External Site)
Cause:   Access control error, Randomization error
Underlying OS:  Windows (NT), Windows (2000), Windows (XP)

Message History:   None.


 Source Message Contents

Subject:  Dameware Passes Weak File Encryption Key in the Clear




Dameware Mini Remote Control version 4.1.0.0 and presumably other versions pass a Blowfish encryption key over the wire in the clear.
  It is bad enough that they appear to be using Blowfish in Electronic Codebook Mode; but they compound their errors by the following
 two vulnerabilities.

The Dameware Mini Remote Control offers the capability to transfer files between the host and client encrypted using 128-bit Blowfish
 Encryption.  Their first mistake is using a poor random bit generator to create their encryption key.  After identifying the key
 in the clear I was able to surmise that the lack of cryptographic expertise of the Dameware developers was systemic and checked to
 see if they were using the built-in rand() function to generate the key.  It did not take long to exhaust the small space of the
 key.

int 			i;
unsigned char 	dw_f_key[16];
srand(time(NULL));
for(i=0;i<16;i++){
	dw_f_key[i] = rand();
}

The second major and more serious mistake is that they actually pass the file encryption key in the clear over the wire.  This can
 be seen by analyzing packets between host and target.  In a packet just prior to the file being sent the second to the last string
 of 16-bytes is the file encryption key. 


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC