PeopleSoft PeopleTools PSCipher Password Encryption Weakness
BID:16507
Info
PeopleSoft PeopleTools PSCipher Password Encryption Weakness
| Bugtraq ID: | 16507 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 06 2006 12:00AM |
| Updated: | Dec 13 2006 06:18PM |
| Credit: | Discovered by Dr. Larry Wargo, Barrett McGuire, and Matt Fotter. |
| Vulnerable: |
PeopleSoft PeopleTools 8.46.3 PeopleSoft PeopleTools 8.45.5 PeopleSoft PeopleTools 8.43 PeopleSoft PeopleTools 8.42 PeopleSoft PeopleTools 8.41 PeopleSoft PeopleTools 8.40 PeopleSoft PeopleTools 8.4 |
| Not Vulnerable: | |
Discussion
PeopleSoft PeopleTools PSCipher Password Encryption Weakness
PeopleSoft PeopleTools PSCipher encrypts user passwords with a static key. This results in weak password encryption.
It should be noted that PSCipher is not used to encrypt any application data and data stored in the database. Passwords stored in the database are encrypted using SHA-1.
PeopleTools 8.4 and prior are prone to this issue.
PeopleSoft PeopleTools PSCipher encrypts user passwords with a static key. This results in weak password encryption.
It should be noted that PSCipher is not used to encrypt any application data and data stored in the database. Passwords stored in the database are encrypted using SHA-1.
PeopleTools 8.4 and prior are prone to this issue.
Exploit / POC
PeopleSoft PeopleTools PSCipher Password Encryption Weakness
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution / Fix
PeopleSoft PeopleTools PSCipher Password Encryption Weakness
Solution:
This issue was reportedly addressed in PeopleTools versions 8.47 and later.
The vendor has reported that Enterprise PeopleTools 8.47 and subsequent versions provide Triple DES encryption and an enhanced version of the PSCipher utility including a command-like tool that encrypts a variety of text values stored in various configuration files. The product also provides dynamic key generation to generate unique encryption keys and a key file that maintains a version history of all previous versions of the keys, thus enabling text previously encrypted to be encrypted or decrypted.
The vendor also advises customers to refrain from using PSCipher as a general-purpose routine to protect other types of data.
Solution:
This issue was reportedly addressed in PeopleTools versions 8.47 and later.
The vendor has reported that Enterprise PeopleTools 8.47 and subsequent versions provide Triple DES encryption and an enhanced version of the PSCipher utility including a command-like tool that encrypts a variety of text values stored in various configuration files. The product also provides dynamic key generation to generate unique encryption keys and a key file that maintains a version history of all previous versions of the keys, thus enabling text previously encrypted to be encrypted or decrypted.
The vendor also advises customers to refrain from using PSCipher as a general-purpose routine to protect other types of data.
References
PeopleSoft PeopleTools PSCipher Password Encryption Weakness
References:
References: