Back to Advisories

Advisories

Rapid7 Advisory R7-0022: Symantec Scan Engine Known Immutable DSA Private Key

CVE: CVE-2006-0231

Summary

April 21, 2006 - Symantec Scan Engine exhibits a vulnerability in the way it generates the SSL private key used for protecting communications over TCP port 8005. This port is used to exchange sensitive configuration and control commands between the server and the administrative control application.

While all data over this port is protected using SSL, Rapid7 has found that every installation of Symantec Scan Engine uses the same private DSA key. This immutable key cannot be changed by end users and can be extracted easily from any installation of this product.

This design flaw renders the SSL protection useless. A man-in-the-middle attacker could easily intercept and decrypt all communications between Symantec Scan Engine and an administrative client.

Nexpose, Rapid7's award-winning vulnerability assessment platform, checks for this vulnerability and other vulnerabilities we have discovered in Symantec Scan Engine. Visit http://www.rapid7.com to register for a free demo of Nexpose.

Affected system(s):

KNOWN VULNERABLE:

  • Symantec Scan Engine v5.0.0.24

KNOWN FIXED:

  • Symantec Scan Engine v5.1.0.7

UNKNOWN (PROBABLY VULNERABLE):

  • All v5.0.x.x
  • Earlier versions

Vendor Info

Symantec Corporation
http://www.symantec.com

Symantec was notified of this vulnerability on January 17, 2006. They acknowledged the vulnerability, then provided us with a fixed version. Rapid7's advisory was publicly released on April 21, 2006.

Detailed Analysis

Symantec Scan Engine's administrative client exchanges sensitive configuration information with the server using a proprietary protocol protected by SSL which runs by default on TCP port 8005. This built-in SSL server is used, for example, to transmit the administrator password hash when changing the password. It is crucial for this communication channel to remain private, authenticated, and reliable.

A critical design error has been made in the way SSL protection is employed. The use of a particular DSA private key, pre-generated by Symantec, is enforced in their SSL server in all tested versions of Symantec Scan Engine. End users are offered no way to change the key, and the key itself can be relatively easily extracted from any installation. The key can be found in the file "servers.jar" (located by default in "C:\Program Files\Symantec\Scan Engine"), which contains a java keystore file "com/symantec/jsse/serverKeys" protected by the password "secret". The key entry is stored under the alias "server" and is protected by the password "secret".

This known immutable key renders SSL protection useless since the private key is known to anybody (see below for the key in PEM format). All Scan Engine installations use the same key. For example, attackers can combine ARP or DNS spoofing attacks with the knowledge of the private key to conduct man-in-the-middle attacks.

-----BEGIN DSA PRIVATE KEY-----
MIIBuwIBAAKBgQD9f1OBHXUSKVLfSpwu7OTn9hG3UjzvRADDHj+AtlEmaUVdQCJR +1k9jVj6v8X1ujD2y5tVbNeBO4AdNG/yZmC3a5lQpaSfn+gEexAiwk+7qdf+t8Yb +DtX58aophUPBPuD9tPFHsMCNVQTWhaRMvZ1864rYdcq7/IiAxmd0UgBxwIVAJdg UI8VIwvMspK5gqLrhAvwWBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5lK+7+jrqgvlX TAs9B4JnUVlXjrrUWU/mcQcQgYC0SRZxI+hMKBYTt88JMozIpuE8FnqLVHyNKOCj rh4rs6Z1kW6jfwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf4VrlnwaSi2ZegHtVJWQB TDv+z0kqAoGAE9rKDKa4eOROFXX1/jy7sLH34OGTbTmsqYoEBTJt8DolJkr6L4kf SyOzpIhKB440mmXZMQJbXy0WNBCGzPjq6OHpI60KuBTskWAtPBEGE1jiov/7jK9b wCt6sTBqo3Ux5ygyjuFQyt89d+qTp9761Z32OvaBq+IJvZYWNM8M/2ECFDLgCI85 fJtA3mlq9Q1T6U36Kl7x
-----END DSA PRIVATE KEY-----

The private component of this DSA key is X:

X = 0x32e0088f397c9b40de696af50d53e94dfa2a5ef1

A tool such as ssldump can be used to confirm the validity of the private key as shown above, by manually comparing its public part to the DSA public key embedded in the SSL server's certificate displayed by ssldump.

This vulnerability was discovered by Marc Bevand of Rapid7.

Solution

Upgrade to Symantec Scan Engine v5.1.0.7 or later.

Disclaimer & Copyright

Rapid7, LLC is not responsible for the misuse of the information provided in our security advisories. These advisories are a service to the professional security community. There are NO WARRANTIES with regard to this information. Any application or distribution of this information constitutes acceptance AS IS, at the user's own risk. This information is subject to change without notice.

This advisory Copyright (C) 2006 Rapid7, LLC. Permission is hereby granted to redistribute this advisory, providing that no changes are made and that the copyright notices and disclaimers remain intact.