Verax NMS Hardcoded Private Key (CVE-2013-1352) I. BACKGROUND ---------------------- Verax NMS provides a service-oriented, unified management & monitoring of networks, applications and infrastructure enabling quick problem detection, root-cause analysis, reporting and automating recovery, reducing costs and shortening downtimes of IT service delivery. Source: http://www.veraxsystems.com/en/products/nms II. DESCRIPTION ---------------------- In versions prior to 2.1.0 of VeraxNMS, the server-side component eadministratorconsole-core-1.5.2.jar, contains a method named decryptPassword(). This method provides the functionality to decrypt a user's password using an implementation of RSA. Within com.veraxsystems.eadministratorconsole.remote.service.impl, it has been discovered that decryptPassword() uses a static, hardcoded private key to facilitate this process. As a result, these passwords should be considered insecure due to the fact that recovering the private key is decidedly trivial. III. AFFECTED PRODUCTS ---------------------- All versions of Verax NMS prior to 2.1.0 are vulnerable. IV. RECOMMENDATION ---------------------- Users should upgrade to version 2.1.0 of Verax NMS. V. CREDIT ---------------------- This vulnerability was discovered by Andrew Brooks. VI. REFERENCES ---------------------- CVE-2013-1352 CVE-2013-1351 (Related) http://download.veraxsystems.com/download/nms-2.1.0-release-notes.txt VII. TIMELINE ---------------------- 1/10/2013 - Vendor notified 1/11/2013 - Vendor acknowledges bug report 2/20/2013 - Vulnerability remediated and pushed to mainline