OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
[SA11205] DameWare Mini Remote Control Weak Encryption Implementation

From: Secunia Security Advisories (sec-advsecunia.com)
Date: Wed Mar 24 2004 - 07:44:41 CST

TITLE:
DameWare Mini Remote Control Weak Encryption Implementation

SECUNIA ADVISORY ID:
SA11205

VERIFY ADVISORY:
http://secunia.com/advisories/11205/

CRITICAL:
Moderately critical

IMPACT:
Exposure of sensitive information

WHERE:
From remote

SOFTWARE:
DameWare Mini Remote Control 4.x

DESCRIPTION:
ax09001h has reported a design error in DameWare Mini Remote Control,
possibly allowing malicious people to gain knowledge of the
encryption key.

The problem is that the Blowfish encryption key is transmitted in
plaintext when transferring files. This effectively allows anyone,
who can sniff traffic, to decrypt the encrypted data.

Also, the random function is reportedly weak. The random generator
isn't truely random and may allow malicious people to enumerate or
predict the encryption key.

The issues have been reported in version 4.1.0.0. Other versions may
also be affected.

SOLUTION:
Do not rely on DameWare encryption. Use VPN, SSH, SSL, or similar to
tunnel sensitive data.

PROVIDED AND/OR DISCOVERED BY:
ax09001h

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------