RSA Key Manager SQL injection Vulnerability ( CVE-2010-1904 )

[Kyle Quest <kyle.c.quest@xxxxxxxxxxx>]

Product: RSA Key Manager
Vendor: EMC/RSA
Vulnerable Component: Key Manager Client
Vulnerable Component Version: 1.5.x
Vulnerability Type: SQL injection
Vendor Contact Date: 4/20/2010
Status: Vendor does not want to fix the vulnerability.


Vulnerability Details:
RSA Key Manager Client software uses an SQLite database to cache its encryption 
keys. The software fails to properly validate the metadata embedded inside of 
the RSA Key Manager encrypted data when it perform a key lookup when the 
encrypted data is being decrypted.An attacker can inject SQL commands into the 
metadata section of the RSA Key Manager encrypted data, which will be executed 
by the Key Manager Client software. For example, an attacker can inject SQL 
statements to modify existing encryption keys, remove existing encryption keys, 
add new encryption keys, etc.

The Key Manager client uses two types of cache: memory cache and file cache. As 
long as both or either of the caches are enabled the problem can be triggered 
easily. 
RSA Key Manager Client 1.5.x uses the following format when it encrypts data:
Field 1 = KeyIdStringField 2 = NULL TerminatorField 3 = Encryption IVField 4 = 
Encrypted Data
Encryptionn Key Cache tables:
1. "ClassTable" [contains encryption key classes configured on the server]
classID     VARCHAR(255) PRIMARY KEYkeyID       VARCHAR(255) [current key id 
for this key class]refreshTime INT UNSIGNEDupdateTime  INT UNSIGNED
2. "ConfigTable" [includes kekhash - KEK, Key Encryption Key, hash]
name VARCHAR(255) PRIMARY KEYvalue VARCHAR(255)
3. "KeyTable" [holds the cached encryption keys]
keyID       VARCHAR(255) PRIMARY KEYclassID     VARCHAR(255)keyData     
BLOBalgorithm   VARCHAR(255) [usually "AES/CBC"]refreshTime INT 
UNSIGNEDupdateTime  INT UNSIGNED
Sample Injections:
Injecting the following sql code results in a new encryption key in the Key 
Manager (client).
"; INSERT INTO KeyTable VALUES('1111','MyClass','MyKeyData','ABC',1000,2000);--
Injecting something like the sql code below can be used to replace the 
encryption keys used by Key Manager.
"; UPDATE KeyTable SET keyData ='NewKeyData' WHERE classID='MyClass';--

                                          
_________________________________________________________________
Hotmail is redefining busy with tools for the New Busy. Get more from your 
inbox.
http://www.windowslive.com/campaign/thenewbusy?ocid=PID28326::T:WLMTAGL:ON:WL:en-US:WM_HMP:042010_2