Weak encryption scheme in Computer Associates eTrust Intrusion Detection System password

vendor:

eTrust Intrusion Detection System

by:

Unknown

5.5

CVSS

MEDIUM

Weak encryption

326

CWE

Product Name: eTrust Intrusion Detection System

Affected Version From: Computer Associates eTrust Intrusion Detection System (formerly known as SessionWall-3)

Affected Version To: Unknown

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows, Linux, Mac

Unknown

Weak encryption scheme in Computer Associates eTrust Intrusion Detection System password

A weak encryption scheme exists in Computer Associates eTrust Intrusion Detection System (formerly known as SessionWall-3) password which authorizes users to view and configure the application's registry settings. Provided that either a remote or local user has access to the registry, it is possible to decrypt the password into plaintext with the use of an exploit tool (sw3passw.exe) or through simple XORing techniques.

Mitigation:

Computer Associates eTrust Intrusion Detection System users should apply patches or updates provided by the vendor to address the weak encryption issue. It is recommended to use strong encryption algorithms and secure storage methods for passwords.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1341/info

A weak encryption scheme exists in Computer Associates eTrust Intrusion Detection System (formerly known as SessionWall-3) password which authorizes users to view and configure the application's registry settings.

Provided that either a remote or local user has access to the registry, it is possible to decrypt the password into plaintext with the use of an exploit tool (sw3passw.exe) or through simple XORing techniques.

This password along with the key is stored in the following registry location:
HKEY_LOCAL_MACHINE\Software\ComputerAssociates\SessionWall\1.0\Security\AdminPassword

The first byte will be the length of the key (n), the next (n) bytes are the key, the remaining bytes are the encrypted password with the exception of the last byte which is a terminating null. 

20012-1.exe - Administrator password decryptor for Win 9x/NT.
20012-2.zip - Source code (use TASM). 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20012-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20012-2.zip