Finjan SurfinGate Password Ciphering Weaknesses

Bugtraq ID:	6705
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 28 2003 12:00AM
Updated:	Jan 28 2003 12:00AM
Credit:	The discovery of this vulnerability has been credited to Compass Security.
Vulnerable:	Finjan Software SurfinGate 7.0 Finjan Software SurfinGate 6.0 5 Finjan Software SurfinGate 6.0 1 Finjan Software SurfinGate 6.0 Finjan Software SurfinGate 5.6
Not Vulnerable:

Finjan SurfinGate Password Ciphering Weaknesses

It has been reported that Finjan SurfinGate uses weak algorithms to encrypt the Console and Oracle passwords. Both passwords are stored on the local system and are accessible by local users.

A malicious local user may trivially decrypt stored passwords implementing the weak algorithms. This may aid the attacker in launching further attacks against a target system and the filtering software.

Finjan SurfinGate Password Ciphering Weaknesses

No exploit is required.

Finjan SurfinGate Password Ciphering Weaknesses

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Finjan SurfinGate Password Ciphering Weaknesses

References:

• SurfinGate Product Page (Finjan Software)
  
• RE: Tech Article: HTTP Content Filter Analysis - Finjan SurfinGate V5.6 ("Menashe Eliezer" )
  
• Tech Article: HTTP Content Filter Analysis - Finjan SurfinGate v5.6 ("[email protected]" )