Sophos Endpoint Protection 10.7 Insecure Cryptography Vulnerability

[+] Credits: John Page (aka hyp3rlinx)    

Vendor:
==========
www.sophos.com



Product:
===========
Sophos Endpoint Protection - Control Panel v10.7

Sophos Endpoint Protection helps secure your workstation by adding prevention, detection, and response technology on top of your operating system.
Sophos Endpoint Protection is designed for workstations running Windows and macOS. It adds exploit technique mitigations, CryptoGuard anti-ransomware,
anti-malware, web security, malicious traffic detection, and deep system cleanup.



Vulnerability Type:
===================
Insecure Crypto



CVE Reference:
==============
CVE-2018-9233



Security Issue:
================
Sophos endpoint protection control panel authentication uses weak unsalted unicoded cryptographic hash (SHA1) function, not using salt allows attackers that gain access to hash 
ability to conduct faster cracking attacks using pre-computed dictionaries, e.g. rainbow tables. This can potentially result in unauthorized access that could allow for
changing of settings, whitelist or unquarantine files.

Password and config for Sophos endpoint protection control panel is stored here:
C:\ProgramData\Sophos\Sophos Anti-Virus\Config\machine.xml

e.g.

SHA1 (Unicode) encoding non salted pass = abc123

<TamperProtectionManagement><settings>
<enabled>true</enabled><password>689307D2FC53AF0FB941BC1BB42737CE4F3EF540</password></settings>
</TamperProtectionManagement>


Using PHP's sha1 function with "mb_convert_encoding" as UTF-16LE we can verify.

C:\>php -r "print sha1(mb_convert_encoding('abc123', 'UTF-16LE', 'UTF-8'));"
689307d2fc53af0fb941bc1bb42737ce4f3ef540

#  0day.today [2018-04-09]  #