Main Vulnerability Database Vulnerabilities #VU20850

#VU20850 Insecure cryptographic storage in Defender

Published: September 4, 2019

Vulnerability identifier: #VU20850

Vulnerability risk: Medium

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: N/A

CWE-ID: CWE-310

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Defender

Software vendor:
One Identity

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the software stores token seeds, PAP secrets, and user passwords in Active Directory attributes. Defender passwords are hashed using MD5 in conjunction with a static key for obfuscation, which allows a remote authenticated user to read the computed hash from the defender-user TokenData attribute in Active Directory and then use it in an offline brute force attack.

Remediation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

External links

https://seclists.org/fulldisclosure/2019/Sep/4