Rapid7 Advisory R7-0022: Symantec Scan Engine Known Immutable DSA Private Key
_______________________________________________________________________
Rapid7, LLC Security Advisory
_______________________________________________________________________
Rapid7 Advisory R7-0022
Symantec Scan Engine Known Immutable DSA Private Key
Published: April 21, 2006
Revision: 1.0
http://www.rapid7.com/advisories/R7-0022.html
CVE: CVE-2006-0231
1. Affected system(s):
KNOWN VULNERABLE:
o Symantec Scan Engine v5.0.0.24
KNOWN FIXED:
o Symantec Scan Engine v5.1.0.7
UNKNOWN (PROBABLY VULNERABLE):
o All v5.0.x.x
o Earlier versions
2. Summary
Symantec Scan Engine exhibits a vulnerability in the way it
generates the SSL private key used for protecting communications
over TCP port 8005. This port is used to exchange sensitive
configuration and control commands between the server and the
administrative control application.
While all data over this port is protected using SSL, Rapid7 has
found that every installation of Symantec Scan Engine uses the same
private DSA key. This immutable key cannot be changed by end users
and can be extracted easily from any installation of this product.
This design flaw renders the SSL protection useless. A
man-in-the-middle attacker could easily intercept and decrypt all
communications between Symantec Scan Engine and an administrative
client.
NeXpose, Rapid7's award-winning vulnerability assessment platform,
checks for this vulnerability and other vulnerabilities we have
discovered in Symantec Scan Engine. Visit http://www.rapid7.com
to register for a free demo of NeXpose.
3. Vendor status and information
Symantec Corporation
http://www.symantec.com
Symantec was notified of this vulnerability on January 17, 2006.
They acknowledged the vulnerability, then provided us with a
fixed version. Rapid7's advisory was publicly released on April 21,
2006.
4. Solution
Upgrade to Symantec Scan Engine v5.1.0.7 or later.
5. Detailed analysis
Symantec Scan Engine's administrative client exchanges sensitive
configuration information with the server using a proprietary
protocol protected by SSL which runs by default on TCP port 8005.
This built-in SSL server is used, for example, to transmit the
administrator password hash when changing the password. It is
crucial for this communication channel to remain private,
authenticated, and reliable.
A critical design error has been made in the way SSL protection is
employed. The use of a particular DSA private key, pre-generated by
Symantec, is enforced in their SSL server in all tested versions of
Symantec Scan Engine. End users are offered no way to change the key,
and the key itself can be relatively easily extracted from any
installation. The key can be found in the file "servers.jar"
(located by default in "C:\Program Files\Symantec\Scan Engine"),
which contains a java keystore file "com/symantec/jsse/serverKeys"
protected by the password "secret". The key entry is stored under
the alias "server" and is protected by the password "secret".
This known immutable key renders SSL protection useless since the
private key is known to anybody (see below for the key in PEM
format). All Scan Engine installations use the same key. For example,
attackers can combine ARP or DNS spoofing attacks with the knowledge
of the private key to conduct man-in-the-middle attacks.
-----BEGIN DSA PRIVATE KEY-----
MIIBuwIBAAKBgQD9f1OBHXUSKVLfSpwu7OTn9hG3UjzvRADDHj+AtlEmaUVdQCJR
+1k9jVj6v8X1ujD2y5tVbNeBO4AdNG/yZmC3a5lQpaSfn+gEexAiwk+7qdf+t8Yb
+DtX58aophUPBPuD9tPFHsMCNVQTWhaRMvZ1864rYdcq7/IiAxmd0UgBxwIVAJdg
UI8VIwvMspK5gqLrhAvwWBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5lK+7+jrqgvlX
TAs9B4JnUVlXjrrUWU/mcQcQgYC0SRZxI+hMKBYTt88JMozIpuE8FnqLVHyNKOCj
rh4rs6Z1kW6jfwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf4VrlnwaSi2ZegHtVJWQB
TDv+z0kqAoGAE9rKDKa4eOROFXX1/jy7sLH34OGTbTmsqYoEBTJt8DolJkr6L4kf
SyOzpIhKB440mmXZMQJbXy0WNBCGzPjq6OHpI60KuBTskWAtPBEGE1jiov/7jK9b
wCt6sTBqo3Ux5ygyjuFQyt89d+qTp9761Z32OvaBq+IJvZYWNM8M/2ECFDLgCI85
fJtA3mlq9Q1T6U36Kl7x
-----END DSA PRIVATE KEY-----
The private component of this DSA key is X:
X = 0x32e0088f397c9b40de696af50d53e94dfa2a5ef1
A tool such as ssldump can be used to confirm the validity of the
private key as shown above, by manually comparing its public part to
the DSA public key embedded in the SSL server's certificate
displayed by ssldump.
6. Credit
This vulnerability was discovered by Marc Bevand of Rapid7.
7. Contact Information
Rapid7, LLC
Email: advisory@xxxxxxxxxx
Web: http://www.rapid7.com
Phone: +1 (617) 247-1717
8. Disclaimer and Copyright
Rapid7, LLC is not responsible for the misuse of the information
provided in our security advisories. These advisories are a service
to the professional security community. There are NO WARRANTIES with
regard to this information. Any application or distribution of this
information constitutes acceptance AS IS, at the user's own risk.
This information is subject to change without notice.
This advisory Copyright (C) 2006 Rapid7, LLC. Permission is hereby
granted to redistribute this advisory, providing that no changes are
made and that the copyright notices and disclaimers remain intact.