Strip Password Generator Limited Password-Space Vulnerability
BID:2567
Info
Strip Password Generator Limited Password-Space Vulnerability
| Bugtraq ID: | 2567 |
| Class: | Unknown |
| CVE: |
CVE-2001-0597 |
| Remote: | No |
| Local: | Yes |
| Published: | Apr 10 2001 12:00AM |
| Updated: | Jul 11 2009 06:06AM |
| Credit: | This vulnerability was announced to Bugtraq by Thomas Roessler <[email protected]> on April 10, 2001. |
| Vulnerable: |
Zetetic Enterprises Strip 0.5 Zetetic Enterprises Strip 0.4 Zetetic Enterprises Strip 0.3 |
| Not Vulnerable: | |
Discussion
Strip Password Generator Limited Password-Space Vulnerability
Strip is a password generation utility made freely available by Zetetic Enterprises. Strip is a PalmOS based application designed to generate and store important passwords.
A problem with Strip makes it possible for a user that has attained an encrypted password generated with Strip to easily guess the password. The pseudo-random number generation is done through the SysRandom() syscall of PalmOS, which offers simplistic number generation. Additionally, the PNRG is seeded with number that may be small depending on the operation time of the Palm device. Finally, the maximum size of the seed is 16 bits.
Therefore, it is possible for a user to easily guess passwords generated with Strip, which have a maximum of 2^16 possibilities.
Strip is a password generation utility made freely available by Zetetic Enterprises. Strip is a PalmOS based application designed to generate and store important passwords.
A problem with Strip makes it possible for a user that has attained an encrypted password generated with Strip to easily guess the password. The pseudo-random number generation is done through the SysRandom() syscall of PalmOS, which offers simplistic number generation. Additionally, the PNRG is seeded with number that may be small depending on the operation time of the Palm device. Finally, the maximum size of the seed is 16 bits.
Therefore, it is possible for a user to easily guess passwords generated with Strip, which have a maximum of 2^16 possibilities.
Exploit / POC
Strip Password Generator Limited Password-Space Vulnerability
Exploit available:
Exploit available: