Demarc PureSecure Weak Password Encryption Vulnerability
BID:4238
Info
Demarc PureSecure Weak Password Encryption Vulnerability
| Bugtraq ID: | 4238 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 02 2002 12:00AM |
| Updated: | Mar 02 2002 12:00AM |
| Credit: | Discovery is credited to <[email protected]>. |
| Vulnerable: |
Demarc PureSecure 1.0.5 Windows Demarc PureSecure 1.0.5 Unix |
| Not Vulnerable: | |
Discussion
Demarc PureSecure Weak Password Encryption Vulnerability
Demarc PureSecure is a commercially available graphical front-end for Snort, in addition to being a generalized network monitoring solution. Snort is a popular open-source NIDS (Network Intrusion Detection System). Demarc will run on most Linux and Unix variants, as well as Microsoft Windows NT/2000/XP operating systems.
Users are authenticated into the Demarc PureSecure Snort front-end via a MySQL database. The password used by Demarc is allegedly not properly salted before it is encrypted. The result is that the first two characters remain in plaintext. Additionally, the strength of the encryption algorithm is weakened significantly. The hash of the weakly encrypted password may be viewed by a local attacker who has access to the Snort database.
A local attacker may theoretically exploit this issue to mount a dictionary attack against the weakly encrypted authentication credential.
Demarc PureSecure is a commercially available graphical front-end for Snort, in addition to being a generalized network monitoring solution. Snort is a popular open-source NIDS (Network Intrusion Detection System). Demarc will run on most Linux and Unix variants, as well as Microsoft Windows NT/2000/XP operating systems.
Users are authenticated into the Demarc PureSecure Snort front-end via a MySQL database. The password used by Demarc is allegedly not properly salted before it is encrypted. The result is that the first two characters remain in plaintext. Additionally, the strength of the encryption algorithm is weakened significantly. The hash of the weakly encrypted password may be viewed by a local attacker who has access to the Snort database.
A local attacker may theoretically exploit this issue to mount a dictionary attack against the weakly encrypted authentication credential.
Exploit / POC
Demarc PureSecure Weak Password Encryption Vulnerability
There is no exploit required. If the attacker is able to view the hash of the weakly encrypted password, this significantly increases the chances of making a successful dictionary attack.
There is no exploit required. If the attacker is able to view the hash of the weakly encrypted password, this significantly increases the chances of making a successful dictionary attack.
Solution / Fix
Demarc PureSecure Weak Password Encryption Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Demarc PureSecure Weak Password Encryption Vulnerability
References:
References:
- Demarc Homepage (Demarc)
- Weak Password Storage in Demarc (Commercial Snort Front-end) (SecuriTeam)