full-disclosure - Re: ZDI-08-025: Symantec Altiris Deployment Solution Domain Credential Disclosure Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <782434a70805151504n37add0dcw8d64f48bbd6ce5bf@mail.gmail.com>
Date: Thu, 15 May 2008 15:04:42 -0700
From: "Professor Micheal Chatner" <mchatner@...il.com>
To: zdi-disclosures@...m.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: ZDI-08-025: Symantec Altiris Deployment
	Solution Domain Credential Disclosure Vulnerability

Fuck you Tippingpoint fags. Go jump off a cliff. LOSERS!

On Thu, May 15, 2008 at 1:25 PM,  <zdi-disclosures@...m.com> wrote:
> ZDI-08-025: Symantec Altiris Deployment Solution Domain Credential
> Disclosure Vulnerability
> http://www.zerodayinitiative.com/advisories/ZDI-08-025
> May 15, 2008
>
> -- Affected Vendors:
> Symantec
>
> -- Affected Products:
> Symantec Altiris Deployment Solution
>
> -- TippingPoint(TM) IPS Customer Protection:
> TippingPoint IPS customers have been protected against this
> vulnerability by Digital Vaccine protection filter ID 5936.
> For further product information on the TippingPoint IPS, visit:
>
>    http://www.tippingpoint.com
>
> -- Vulnerability Details:
> This vulnerability allows attackers to remotely obtain domain
> credentials on vulnerable installations of Symantec Altiris Deployment
> Solution. User
> interaction is not required to exploit this vulnerability.
> Authentication is not required to exploit this vulnerability.
>
> The specific flaw exists within the axengine.exe service listening by
> default on TCP port 402. The service allows a remote client to request
> encrypted domain credentials without authentication. The encryption
> lacks a salt allowing an attacker with a local installation of Altiris
> Deployment Solution to easily decrypt the credentials.
>
> -- Vendor Response:
> Symantec has issued an update to correct this vulnerability. More
> details can be found at:
>
> http://www.symantec.com/avcenter/security/Content/2008.05.14a.html
>
> -- Disclosure Timeline:
> 2008-02-07 - Vulnerability reported to vendor
> 2008-05-15 - Coordinated public release of advisory
>
> -- Credit:
> This vulnerability was discovered by:
>    * Brett Moore of Insomnia Security www.insomniasec.com
>
> -- About the Zero Day Initiative (ZDI):
> Established by TippingPoint, The Zero Day Initiative (ZDI) represents
> a best-of-breed model for rewarding security researchers for responsibly
> disclosing discovered vulnerabilities.
>
> Researchers interested in getting paid for their security research
> through the ZDI can find more information and sign-up at:
>
>    http://www.zerodayinitiative.com
>
> The ZDI is unique in how the acquired vulnerability information is
> used. TippingPoint does not re-sell the vulnerability details or any
> exploit code. Instead, upon notifying the affected product vendor,
> TippingPoint provides its customers with zero day protection through
> its intrusion prevention technology. Explicit details regarding the
> specifics of the vulnerability are not exposed to any parties until
> an official vendor patch is publicly available. Furthermore, with the
> altruistic aim of helping to secure a broader user base, TippingPoint
> provides this vulnerability information confidentially to security
> vendors (including competitors) who have a vulnerability protection or
> mitigation product.
>
> Our vulnerability disclosure policy is available online at:
>
>    http://www.zerodayinitiative.com/advisories/disclosure_policy/
>
> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments,
> is being sent by 3Com for the sole use of the intended recipient(s) and
> may contain confidential, proprietary and/or privileged information.
> Any unauthorized review, use, disclosure and/or distribution by any
> recipient is prohibited.  If you are not the intended recipient, please
> delete and/or destroy all copies of this message regardless of form and
> any included attachments and notify 3Com immediately by contacting the
> sender via reply e-mail or forwarding to 3Com at postmaster@...m.com.
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/