Tembria Server Monitor Weak Cryptographic Password Storage Vulnerability

[robkraus@xxxxxxxxxxxxxxx]

Tembria Server Monitor Weak Cryptographic Password Storage Vulnerability

Solutionary ID: SERT-VDN-1004 

Solutionary Disclosure URL: 
http://www.solutionary.com/index/SERT/Vuln-Disclosures/Tembria-Server-Monitor-Weak-Xpto-Pwd-Storage.html

CVE ID: Pending 

Product: Tembria Server Monitor 

Application Vendor: Tembria 

Vendor URL: http://www.tembria.com/products/servermonitor/index.html 
Date discovered: 1/22/2011 

Discovered by: Rob Kraus and Solutionary Engineering Research Team (SERT) 

Vendor notification date: 1/25/2011 

Vendor response date: 1/25/2011 

Vendor acknowledgment date: 1/25/2011 

Public disclosure date: 2/14/2011

Type of vulnerability: Weak Cryptography - Design Flaw

Exploit Vectors: Local

Vulnerability Description: A vulnerability exists in the Tembria Server Monitor 
application allowing an attacker to easily decrypt usernames and passwords used 
to authenticate to the application. This is a second level attack that requires 
access to the password files stored within the application directory. The 
application implements a simple substitution cipher to obfuscate the values of 
plaintext usernames and passwords. Obfuscation of the usernames and passwords 
is achieved by encrypting them to represent numeric values that are three 
characters wide (i.e. e = 057). An attacker who has previously compromised the 
host operating system or achieved direct access to the authentication.dat file 
found in the "\Tembria\Server Monitor" directory can obtain the encrypted user 
credentials and decrypt them with little effort. Credentials using the same 
encryption can also be found in XML files located in the "\Tembria\Server 
Monitor\Exports" directory. 

Tested on: Windows XP, SP3, with Tembria Server Monitor v6.0.4 - Build 2229 
default installation. 

Affected software versions: Tembria Server Monitor v6.0.4 - Build 2229 default 
installation

Impact: In cases where access to the previously mentioned files is obtained, an 
attacker can decrypt all username and password values and potentially reuse 
them for authentication to other systems within the network environment.

Fixed in: Tembria Server Monitor v6.0.5 - Build 2252

Remediation guidelines: The vendor has created a fix to address the discovered 
issues. Upgrade to Tembria Server Monitor v6.0.5 - Build 2252 or later.