what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Verax NMS Hardcoded Private Key

Verax NMS Hardcoded Private Key
Posted Mar 7, 2013
Authored by Andrew Brooks

In versions prior to 2.1.0 of VeraxNMS, the server-side component eadministratorconsole-core-1.5.2.jar, contains a method named decryptPassword(). This method provides the functionality to decrypt a user's password using an implementation of RSA. Within com.veraxsystems.eadministratorconsole.remote.service.impl, it has been discovered that decryptPassword() uses a static, hardcoded private key to facilitate this process. As a result, these passwords should be considered insecure due to the fact that recovering the private key is decidedly trivial.

tags | exploit, remote
advisories | CVE-2013-1352
SHA-256 | 55feaa6ff716167b15cd4b70dd26eae40f7ecebefd6e0d42d6e9cc2abd1cd56a

Verax NMS Hardcoded Private Key

Change Mirror Download
Verax NMS Hardcoded Private Key (CVE-2013-1352)

I. BACKGROUND
----------------------
Verax NMS provides a service-oriented, unified
management & monitoring of networks, applications
and infrastructure enabling quick problem detection,
root-cause analysis, reporting and automating recovery,
reducing costs and shortening downtimes of IT service delivery.

Source: http://www.veraxsystems.com/en/products/nms

II. DESCRIPTION
----------------------
In versions prior to 2.1.0 of VeraxNMS, the server-side component
eadministratorconsole-core-1.5.2.jar, contains a method named
decryptPassword(). This method provides the functionality
to decrypt a user's password using an implementation of RSA.
Within com.veraxsystems.eadministratorconsole.remote.service.impl,
it has been discovered that decryptPassword() uses a static,
hardcoded private key to facilitate this process. As a result,
these passwords should be considered insecure due to the fact
that recovering the private key is decidedly trivial.

III. AFFECTED PRODUCTS
----------------------
All versions of Verax NMS prior to 2.1.0 are vulnerable.

IV. RECOMMENDATION
----------------------
Users should upgrade to version 2.1.0 of Verax NMS.

V. CREDIT
----------------------
This vulnerability was discovered by Andrew Brooks.

VI. REFERENCES
----------------------
CVE-2013-1352
CVE-2013-1351 (Related)
http://download.veraxsystems.com/download/nms-2.1.0-release-notes.txt

VII. TIMELINE
----------------------
1/10/2013 - Vendor notified
1/11/2013 - Vendor acknowledges bug report
2/20/2013 - Vulnerability remediated and pushed to mainline
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    8 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    11 Files
  • 23
    Apr 23rd
    68 Files
  • 24
    Apr 24th
    23 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close