CVE: CVE-2010-1904

Product: RSA Key Manager

Vendor: EMC/RSA

Vulnerable Component: Key Manager Client

Vulnerable Component Version: 1.5.x

Vulnerability Type: SQL injection

Vendor Contact Date: 4/20/2010

Status: Vendor does not want to fix the vulnerability.



Vulnerability Details:

RSA Key Manager Client software uses an SQLite database to cache its
encryption keys.
The software fails to properly validate the metadata embedded inside of the
RSA Key Manager
encrypted data when it perform a key lookup when the encrypted data is being
decrypted.
An attacker can inject SQL commands into the metadata section of the RSA Key
Manager
encrypted data, which will be executed by the Key Manager Client software.
For example, an attacker can inject SQL statements to modify existing
encryption keys,
remove existing encryption keys, add new encryption keys, etc.


The Key Manager client uses two types of cache: memory cache and file
cache.
As long as both or either of the caches are enabled the problem can be
triggered easily.

RSA Key Manager Client 1.5.x uses the following format when it encrypts
data:

Field 1 = KeyIdString
Field 2 = NULL Terminator
Field 3 = Encryption IV
Field 4 = Encrypted Data

Encryptionn Key Cache tables:

1. "ClassTable" [contains encryption key classes configured on the server]

classID     VARCHAR(255) PRIMARY KEY
keyID       VARCHAR(255) [current key id for this key class]
refreshTime INT UNSIGNED
updateTime  INT UNSIGNED

2. "ConfigTable" [includes kekhash - KEK, Key Encryption Key, hash]

name VARCHAR(255) PRIMARY KEY
value VARCHAR(255)

3. "KeyTable" [holds the cached encryption keys]

keyID       VARCHAR(255) PRIMARY KEY
classID     VARCHAR(255)
keyData     BLOB
algorithm   VARCHAR(255) [usually "AES/CBC"]
refreshTime INT UNSIGNED
updateTime  INT UNSIGNED

Sample Injections:

Injecting the following sql code results in a new encryption key in the Key
Manager (client).

"; INSERT INTO KeyTable
VALUES('1111','MyClass','MyKeyData','ABC',1000,2000);--

Injecting something like the sql code below can be used to replace
the encryption keys used by Key Manager.

"; UPDATE KeyTable SET keyData ='NewKeyData' WHERE classID='MyClass';--