Microsoft Windows Network Monitor Weak Password Encryption Vulnerability

Bugtraq ID:	6788
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	May 07 1996 12:00AM
Updated:	May 07 1996 12:00AM
Credit:	Discovery of this vulnerability has been credited to [email protected].
Vulnerable:	Microsoft Windows NT Server 4.0 Microsoft Windows NT Enterprise Server 4.0 Microsoft Network Monitor 1.0 + Microsoft Systems Management Server 1.2 + Microsoft Systems Management Server 1.2 + Microsoft Windows NT 3.5.1 SP5 + Microsoft Windows NT 3.5.1 SP5 + Microsoft Windows NT 3.5.1 SP4 + Microsoft Windows NT 3.5.1 SP4 + Microsoft Windows NT 3.5.1 SP3 + Microsoft Windows NT 3.5.1 SP3 + Microsoft Windows NT 3.5.1 SP2 + Microsoft Windows NT 3.5.1 SP2 + Microsoft Windows NT 3.5.1 SP1 + Microsoft Windows NT 3.5.1 SP1 + Microsoft Windows NT 3.5.1 + Microsoft Windows NT 3.5.1 + Microsoft Windows NT 3.5 + Microsoft Windows NT 3.5 + Microsoft Windows NT Server 4.0 SP6a + Microsoft Windows NT Server 4.0 SP6a + Microsoft Windows NT Server 4.0 SP6 + Microsoft Windows NT Server 4.0 SP6 + Microsoft Windows NT Server 4.0 SP5 + Microsoft Windows NT Server 4.0 SP5 + Microsoft Windows NT Server 4.0 SP4 + Microsoft Windows NT Server 4.0 SP4 + Microsoft Windows NT Server 4.0 SP3 + Microsoft Windows NT Server 4.0 SP3 + Microsoft Windows NT Server 4.0 SP2 + Microsoft Windows NT Server 4.0 SP2 + Microsoft Windows NT Server 4.0 SP1 + Microsoft Windows NT Server 4.0 SP1 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Server 4.0
Not Vulnerable:

Microsoft Windows Network Monitor Weak Password Encryption Vulnerability

An issue has been reported in Network Monitor, which could allow a user to reveal authentication information.

Reportedly, NetMon stores administration passwords using a weak encryption method in the linked library 'BHSUPP.DLL'. Therefore if an attacker obtains access to 'BHSUPP.DLL' residing on a local system, they may be able to reveal NetMon administration authentication credentials.

Microsoft Windows Network Monitor Weak Password Encryption Vulnerability

The following proof of concept exploit was supplied by [email protected]:

http://packetstorm.decepticons.org/Exploit_Code_Archive/netMonExploit.tgz

Microsoft Windows Network Monitor Weak Password Encryption Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Windows Network Monitor Weak Password Encryption Vulnerability

References:

• Windows NT Network Monitor Exploitation ([email protected])