Programi Bilanc Build 007 Release 014 31.01.2020 Static Key Vulnerability--
Kod:
Programi Bilanc - Build 007 Release 014 31.01.2020 - Broken encryption with guessable static encryption key
===============================================================================
Identifiers
-------------------------------------------------
CVE-2020-11719
Vendor
-------------------------------------------------
Balanc Shpk (https://bilanc.com)
Product
-------------------------------------------------
Programi Bilanc
Affected versions
-------------------------------------------------
Programi Bilanc - Build 007 Release 014 31.01.2020 and possibly below
Credit
-------------------------------------------------
Georg Ph E Heise (@gpheheise) / Lufthansa Industry Solutions (@LHIND_DLH)
Vulnerability summary
-------------------------------------------------
Remote attacker can decrypt data with minimal effort while local attackers can obtain the static key from the source code.
Technical details
------------------------------------------------
Remote attacker can decrypt data with minimal effort as the encryption used is outdated and broken. Local attackers with access to the software can obtain the static key from the source code.
Proof of concept
-------------------------------------------------
Withheld
Solution
-------------------------------------------------
Don’t use the software in its current version & contact vendor for a solution
Timeline
-------------------------------------------------
Date| Status
------------|--------------------
01–APR-2020 | Reported to vendor
30-JUN-2020 | End of 90 days Full Disclosure Time
17-DEZ-2020 | FULL disclosure
# 0day.today [2020-12-19] #