Counterpane Password Safe不安全随机数发生漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1195645 漏洞类型 设计错误
发布时间 2006-03-23 更新时间 2007-08-27
CVE编号 CVE-2006-1378 CNNVD-ID CNNVD-200603-392
漏洞平台 N/A CVSS评分 4.9
|漏洞来源
https://cxsecurity.com/issue/WLB-2006030106
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200603-392
|漏洞详情
PasswordSafe3.0beta,当运行于WindowsXP之前版本上时,在数据库加密密钥生成期间,使用一个弱随机数生成器(C++rand函数),从而攻击者可通过以下途径解密数据库和窃取口令:采用各种可能的rand()种子值生成密码和实施一个已知plaintext攻击。
|漏洞EXP
Title         : PasswordSafe 3.0 weak random number generator allows key recovery attack
Date          : March 23, 2006
Product       : PasswordSafe 3.0
Discovered by : ElcomSoft Co.Ltd.

Overview
======================================================================

PasswordSafe is a program originally written by security expert
Bruce Schneier (http://www.schneier.com) that allows one to store
users' passwords in single file (called "safe") which is
encrypted and protected by user's master password (called "Safe
Combination") with the Blowfish encryption algorithm. As noted on
PasswordSafe web page, "the program's security has been thoroughly
verified by Counterpane Labs under the supervision of Bruce Schneier,
author of Applied Cryptography and creator of the Blowfish algorithm."

As noted in "Password Safe FAQ", "there is no back door in
PasswordSafe to recover your Safe Combination, but there is a
password-guessing program that some people have used successfully.
The program works by going through a list of possible passwords
and checking each one".

Version 3.0 introduces new password database format which
(theoretically) eliminates security flaw found by ElcomSoft Co. Ltd.
in November 2005, and does not allow an attacker to bypass key
stretching algorithm any more.

However, there is even more serious security flaw in version 3.0,
which allows to recover 256-bit database encryption key in a
reasonable time (under certain conditions). And with the recovered
encryption key, it is to decrypt all database records (logins,
passwords, etc) without the master password (so-called "Safe
Combination").

Details
======================================================================

PasswordSafe 3.0 utilizes two different random number generator (RNG)
functions: Win32 API RtlGenRandom() and standart Visual C++ rand().
RtlGenRandom() is not available on Windows prior to Windows XP (i.e.
Windows 2000, Windows NT, Windows Me) so rand() is used instead.
Specifically, rand() is used to generate 256-bit database encryption
key. It is widely known that using rand() in cryptographic
applications is not secure due to its predictbility and small
internal state.

It is possible to mount guaranteed decryption attack on PasswordSafe
3.0 databases created under OS prior to Windows XP. The attack is
very simple:

1. Generate 256-bit key for every possible seed value 
 2. Decrypt first database record (the structure is documented, so
    we have known plaintext attack)
 3) Check decrypted value against the known plaintext

The total number of all possible seed values is limited by 2^32, so
it is quite feasible. Our experiments show that the key can be
recovered in less than 6 hours on the single PC (Pentium 4).

Impact
======================================================================

PasswordSafe is used to store sensitive data, and so the presence
of such flaws may help attacker to disclose user's logins,
passwords and PINs by implementing efficient key recovery attacks.

Solution/workaround
======================================================================

PasswordSafe should not use rand() function; cryptographic RNG should
be used instead.

References
======================================================================

Bruce Schneier - Password Safe
http://www.schneier.com/passsafe.html

Password Safe - Project Info
http://passwordsafe.sourceforge.net/

Password Safe FAQ
http://www.schneier.com/passsafe-faq.html

BugTraq: Schneier's PasswordSafe password validation flaw
http://www.securityfocus.com/archive/1/416873/30/0/threaded

About ElcomSoft Co.Ltd.
======================================================================

Since 1990, ElcomSoft Co.Ltd. (http://www.elcomsoft.com) has been
developing and marketing password recovery, forensics, and security
software for Windows. The company offers a comprehensive line of
password recovery software for more than 80 popular file and document
types, email clients, compression programs, instant messengers, and
other applications. ElcomSoft tools are used by most of the
Fortune 500 corporations, many branches of the military all over the
world, foreign governments, and all major accounting companies.
|参考资料

来源:XF
名称:passwordsafe-key-brute-force(25429)
链接:http://xforce.iss.net/xforce/xfdb/25429
来源:BID
名称:17200
链接:http://www.securityfocus.com/bid/17200
来源:BUGTRAQ
名称:20060323PasswordSafe3.0weakrandomnumbergeneratorallowskeyrecoveryattack
链接:http://www.securityfocus.com/archive/1/archive/1/428552/100/0/threaded
来源:BUGTRAQ
名称:20060907Re:PasswordSafe3.0weakrandomnumbergeneratorallowskeyrecoveryattack
链接:http://www.securityfocus.com/archive/1/archive/1/445509/100/0/threaded
来源:SREASON
名称:618
链接:http://securityreason.com/securityalert/618