Product: RSA Key Manager
Vendor: EMC/RSA
Vulnerable Component: Key Manager Client
Vulnerable Component Version: 1.5.x
Vulnerability Type: SQL injection
Vendor Contact Date: 4/20/2010
Status: Vendor does not want to fix the vulnerability.
Vulnerability Details:
RSA Key Manager Client software uses an SQLite database to cache its encryption keys. The software fails
to properly validate the metadata embedded inside of the RSA Key Manager encrypted data when it perform a
key lookup when the encrypted data is being decrypted.An attacker can inject SQL commands into the metadata
section of the RSA Key Manager encrypted data, which will be executed by the Key Manager Client
software. For example, an attacker can inject SQL statements to modify existing encryption keys, remove
existing encryption keys, add new encryption keys, etc.
The Key Manager client uses two types of cache: memory cache and file cache. As long as both or either of
the caches are enabled the problem can be triggered easily.
RSA Key Manager Client 1.5.x uses the following format when it encrypts data:
Field 1 = KeyIdStringField 2 = NULL TerminatorField 3 = Encryption IVField 4 = Encrypted Data
Encryptionn Key Cache tables:
Hotmail is redefining busy with tools for the New Busy. Get more from your inbox.
http://www.windowslive.com/campaign/thenewbusy?ocid=PID28326::T:WLMTAGL:ON:WL:en-US:WM_HMP:042010_2