Rapid7, LLC Security Advisory
Rapid7 Advisory R7-0022
Symantec Scan Engine Known Immutable DSA Private Key
Published: April 21, 2006
1. Affected system(s):
o Symantec Scan Engine v126.96.36.199
o Symantec Scan Engine v188.8.131.52
UNKNOWN (PROBABLY VULNERABLE):
o All v5.0.x.x
o Earlier versions
Symantec Scan Engine exhibits a vulnerability in the way it
generates the SSL private key used for protecting communications
over TCP port 8005. This port is used to exchange sensitive
configuration and control commands between the server and the
administrative control application.
While all data over this port is protected using SSL, Rapid7 has
found that every installation of Symantec Scan Engine uses the same
private DSA key. This immutable key cannot be changed by end users
and can be extracted easily from any installation of this product.
This design flaw renders the SSL protection useless. A
man-in-the-middle attacker could easily intercept and decrypt all
communications between Symantec Scan Engine and an administrative
NeXpose, Rapid7's award-winning vulnerability assessment platform,
checks for this vulnerability and other vulnerabilities we have
discovered in Symantec Scan Engine. Visit http://www.rapid7.com
to register for a free demo of NeXpose.
3. Vendor status and information
Symantec was notified of this vulnerability on January 17, 2006.
They acknowledged the vulnerability, then provided us with a
fixed version. Rapid7's advisory was publicly released on April 21,
Upgrade to Symantec Scan Engine v184.108.40.206 or later.
5. Detailed analysis
Symantec Scan Engine's administrative client exchanges sensitive
configuration information with the server using a proprietary
protocol protected by SSL which runs by default on TCP port 8005.
This built-in SSL server is used, for example, to transmit the
administrator password hash when changing the password. It is
crucial for this communication channel to remain private,
authenticated, and reliable.
A critical design error has been made in the way SSL protection is
employed. The use of a particular DSA private key, pre-generated by
Symantec, is enforced in their SSL server in all tested versions of
Symantec Scan Engine. End users are offered no way to change the key,
and the key itself can be relatively easily extracted from any
installation. The key can be found in the file "servers.jar"
(located by default in "C:\Program Files\Symantec\Scan Engine"),
which contains a java keystore file "com/symantec/jsse/serverKeys"
protected by the password "secret". The key entry is stored under
the alias "server" and is protected by the password "secret".
This known immutable key renders SSL protection useless since the
private key is known to anybody (see below for the key in PEM
format). All Scan Engine installations use the same key. For example,
attackers can combine ARP or DNS spoofing attacks with the knowledge
of the private key to conduct man-in-the-middle attacks.
-----BEGIN DSA PRIVATE KEY-----
-----END DSA PRIVATE KEY-----
The private component of this DSA key is X:
X = 0x32e0088f397c9b40de696af50d53e94dfa2a5ef1
A tool such as ssldump can be used to confirm the validity of the
private key as shown above, by manually comparing its public part to
the DSA public key embedded in the SSL server's certificate
displayed by ssldump.
This vulnerability was discovered by Marc Bevand of Rapid7.
7. Contact Information
Phone: +1 (617) 247-1717
8. Disclaimer and Copyright
Rapid7, LLC is not responsible for the misuse of the information
provided in our security advisories. These advisories are a service
to the professional security community. There are NO WARRANTIES with
regard to this information. Any application or distribution of this
information constitutes acceptance AS IS, at the user's own risk.
This information is subject to change without notice.
This advisory Copyright (C) 2006 Rapid7, LLC. Permission is hereby
granted to redistribute this advisory, providing that no changes are
made and that the copyright notices and disclaimers remain intact.