[FD] Programi Bilanc - Build 007 Release 014 31.01.2020 - Broken encryption with guessable static encryption key [CVE-2020-11719]

[Georg Ph E Heise via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

Programi Bilanc - Build 007 Release 014 31.01.2020 - Broken encryption with 
guessable static encryption key

===============================================================================

Identifiers

-------------------------------------------------

CVE-2020-11719

Vendor

-------------------------------------------------

Balanc Shpk (https://bilanc.com)

Product

-------------------------------------------------

Programi Bilanc

Affected versions

-------------------------------------------------

Programi Bilanc - Build 007 Release 014 31.01.2020 and possibly below

Credit

-------------------------------------------------

Georg Ph E Heise (@gpheheise) / Lufthansa Industry Solutions (@LHIND_DLH)

Vulnerability summary

-------------------------------------------------

Remote attacker can decrypt data with minimal effort while local attackers can 
obtain the static key from the source code.

Technical details

------------------------------------------------

Remote attacker can decrypt data with minimal effort as the encryption used is 
outdated and broken. Local attackers with access to the software can obtain the 
static key from the source code.

Proof of concept

-------------------------------------------------

Withheld

Solution

-------------------------------------------------

Don’t use the software in its current version & contact vendor for a solution

Timeline

-------------------------------------------------

Date| Status

------------|--------------------

01–APR-2020 | Reported to vendor

30-JUN-2020 | End of 90 days Full Disclosure Time

17-DEZ-2020 | FULL disclosure

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/