SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Security)  >   RSA Key Manager Vendors:   EMC, RSA
RSA Key Manager Input Validation Flaw Lets Remote Users Inject SQL Commands
SecurityTracker Alert ID:  1024059
SecurityTracker URL:  http://securitytracker.com/id/1024059
CVE Reference:   CVE-2010-1904   (Links to External Site)
Updated:  Jun 11 2010
Original Entry Date:  Jun 7 2010
Impact:   Disclosure of system information, Disclosure of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.5.x
Description:   A vulnerability was reported in RSA Key Manager. A remote user can inject SQL commands.

The software does not properly validate user-supplied meta data. A user with access to encrypted RSA Key Manager data can supply a specially crafted parameter value to execute SQL commands on the underlying database. This can be exploited to modify existing keys, remove keys, and add new keys.

Systems with Key Manager client memory cache and/or file cache enabled are affected.

The vendor was notified on April 20, 2010.

Kyle Quest reported this vulnerability.

Impact:   A remote user can execute SQL commands on the underlying database.
Solution:   The vendor recommends updating to the latest version (versions 2.0.x and higher are not affected).
Vendor URL:  www.rsa.com/ (Links to External Site)
Cause:   Input validation error
Underlying OS:   Linux (Any), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (Any)

Message History:   None.


 Source Message Contents

Date:  Thu, 03 Jun 2010 14:26:37 -0400
Subject:  RSA Key Manager SQL injection Vulnerability ( CVE-2010-1904 )


Product: RSA Key Manager
Vendor: EMC/RSA
Vulnerable Component: Key Manager Client
Vulnerable Component Version: 1.5.x
Vulnerability Type: SQL injection
Vendor Contact Date: 4/20/2010
Status: Vendor does not want to fix the vulnerability.


Vulnerability Details:
RSA Key Manager Client software uses an SQLite database to cache its encryp=
tion keys.=A0The software fails to properly validate the metadata embedded =
inside of the RSA Key Manager=A0encrypted data when it perform a key lookup=
 when the encrypted data is being decrypted.An attacker can inject SQL comm=
ands into the metadata section of the RSA Key Manager=A0encrypted data=2C w=
hich will be executed by the Key Manager Client software.=A0For example=2C =
an attacker can inject SQL statements to modify existing encryption keys=2C=
=A0remove existing encryption keys=2C add new encryption keys=2C etc.

The Key Manager client uses two types of cache: memory cache and file cache=
.=A0As long as both or either of the caches are enabled the problem can be =
triggered easily.=A0
RSA Key Manager Client 1.5.x uses the following format when it encrypts dat=
a:
Field 1 =3D KeyIdStringField 2 =3D NULL TerminatorField 3 =3D Encryption IV=
Field 4 =3D Encrypted Data
Encryptionn Key Cache tables:
1. "ClassTable" [contains encryption key classes configured on the server]
classID =A0 =A0 VARCHAR(255) PRIMARY KEYkeyID =A0 =A0 =A0 VARCHAR(255) [cur=
rent key id for this key class]refreshTime INT UNSIGNEDupdateTime =A0INT UN=
SIGNED
2. "ConfigTable" [includes kekhash - KEK=2C Key Encryption Key=2C hash]
name VARCHAR(255) PRIMARY KEYvalue VARCHAR(255)
3. "KeyTable" [holds the cached encryption keys]
keyID =A0 =A0 =A0 VARCHAR(255) PRIMARY KEYclassID =A0 =A0 VARCHAR(255)keyDa=
ta =A0 =A0 BLOBalgorithm =A0 VARCHAR(255) [usually "AES/CBC"]refreshTime IN=
T UNSIGNEDupdateTime =A0INT UNSIGNED
Sample Injections:
Injecting the following sql code results in a new encryption key in the Key=
 Manager (client).
"=3B INSERT INTO KeyTable VALUES('1111'=2C'MyClass'=2C'MyKeyData'=2C'ABC'=
=2C1000=2C2000)=3B--
Injecting something like the sql code below can be used to replace=A0the en=
cryption keys used by Key Manager.
"=3B UPDATE KeyTable SET keyData =3D'NewKeyData' WHERE classID=3D'MyClass'=
=3B--

 		 	   		 =20
_________________________________________________________________
Hotmail is redefining busy with tools for the New Busy. Get more from your =
inbox.
http://www.windowslive.com/campaign/thenewbusy?ocid=3DPID28326::T:WLMTAGL:O=
N:WL:en-US:WM_HMP:042010_2=
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC