<<< Date Index >>>     <<< Thread Index >>>

Dameware NT Utilities and MiniRemote Control <= 4.9 vulnerability



Dameware NT Utilities and MiniRemote Control <= 4.9 vulnerability
         

- 1 - Introduction

DameWare NT Utilities is an enterprise system management application for 
Windows NT/2000/XP/2003 which provides an integrated collection of Microsoft 
Windows NT administration utilities incorporating a centralized interface for 
remote management of Windows NT/2000/XP/2003 Servers and Workstations

- 2 - Description -

Dameware NT Utilities and Mini Remote Control <= 4.9 have a vulnerability.

NT Utilities
-------------

When the process DNTUS26 located in the remote machine is dumped from memory to 
a file with PMDump can obtain the user and the password because both are stored 
in clear-text.
Viewing the event id of windows can know the user connected then only opening 
the dump file and searching the user can obtain the password looking for any 
clear-text in the same line of the user.

All utilities (disk,event,groups,open files..cmd view..) are vulnerable but if 
execute CMD Console (not cmd view) and dump the process, searching the word 
"Console" can obtain the user,password,remote user and remote host name.

For example

Console:CrowDat:myplaintextpassword:Y:N:Kurobudetsu:TAMICA2000

Mini Remote Control
-------------------

When the process DWRCS (remote machine or server machine) is dumped from memory 
to a file with PMDump can obtain information of program settings,user name and 
authentication type but not the password.

When the process DWRCC (client machine or local machine) is dumped from memory 
to a file with PMDump can obtain all
users,passwords,hostname/ip,alias and domain name stored for connect with 
alternate credentials, searching the word "sam computers" can find all.

To make easy find the user and password when i tested always find the user and 
password between a short range of lines. To open the txt files i used Notepad++ 
but with notepad or wordpad it's very slowly.

User&Password between lines..

41900-42000 in disk,event,groups,open-files,properties... (NT Utilities)
4550-4600 DWRCC (Mini Remote Control Client)
300-400 DWRCS (Mini Remote Control Server)


- 3 - How to fix it

If Dameware fix this bug download update to the new version

- 4 - Vendor Contact

08/04/2005 Notified to dameware

No response from vendor

- 5 - Credits -

Author: Jordi Corrales ( jordi[at]shellsec.net )
Editor: Fernando Ortega ( fernando[at]shellsec.net )
Date: 15/04/2005
Url: http://www.shellsec.net

Vendor: http://www.dameware.com
PMDump: http://ntsecurity.nu/toolbox/pmdump/
Notepad++: http://notepad-plus.sourceforge.net

English Advisory: http://www.shellsec.net/leer_advisory.php?id=7
Spanish Advisory: http://www.shellsec.net/leer_advisory.php?id=6