Vulnerability Note VU#900031
Faircom c-treeACE database weak obfuscation algorithm vulnerability
Faircom c-treeACE provides a weak obfuscation algorithm (CWE-327) that may be unobfuscated without knowledge of a key or password. The algorithm was formerly called Faircom Standard Encryption but is now called Data Camouflage.
Faircom c-treeACE provides a weak obfuscation algorithm that may be unobfuscated without knowledge of a key or password. Faircom formerly described this algorithm as follows:
FairCom Standard Encryption
Using our Data Camouflage technique provides the means to add an extra level of confidentiality to an application’s data. FairCom designed this approach to mask the file on the disk without sacrificing speed and efficiency, focusing on minimizing performance loss.
Data Camouflage is not intended as a replacement for OS or other security systems, however, as a supplement to existing security. It is suitable for most needs with excellent security vs. performance tradeoffs. With this approach, you can protect data on disk from unauthorized inspection, but any c-treeACE client can access the protected files. To avoid this, the Advanced File Encryption option includes the ability to have hidden keys. Proper implementation of user access controls within c-treeACE is also recommend to prevent unauthorized access to data, even it not masked with the Data Camouflage feature.
An attacker that is able to obtain a c-treeACE database that is obfuscated using the Data Camouflage algorithm (formerly Faircom Standard Encryption) may be able to unobfuscate the database by moving it to a trial install of c-treeACE, deleting the .fcs configuration files and replacing the .fcs files with the default files from the trial. This will allow the attacker to authenticate to the database with default ADMIN/ADMIN credentials and view the contents of the obfuscated database.
An attacker that is able to obtain a database that uses the Data Camouflage algorithm (formerly Faircom Standard Encryption) may be able to unobfuscate the contents of the database.
Use Faircom's Advanced File Encryption
Vendor Information (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Faircom||Affected||25 Apr 2013||20 May 2013|
|Henry Schein||Affected||10 Jun 2013||11 Jun 2013|
CVSS Metrics (Learn More)
Thanks to Justin Shafer for reporting this vulnerability.
This document was written by Jared Allar.
- CVE IDs: CVE-2013-0148
- Date Public: 10 Jun 2013
- Date First Published: 10 Jun 2013
- Date Last Updated: 11 Jun 2013
- Document Revision: 25
If you have feedback, comments, or additional information about this vulnerability, please send us email.