Notified:  July 30, 2013 Updated: July 24, 2015

Status

Affected

Vendor Statement

Overview Baramundi Management Suite versions 7.5 to 8.9 contains multiple vulnerabilities related to clear-text credential storage and transmission. 07/15/2015 Updated Vendor comment: With baramundi Management Suite version 2015 R1 further improvements have been made to close existing problems noted in VU#392654. Therefore, we recommend updating to the latest release version 2015 R1. Addressing issues noted in "CWE-319: Cleartext Transmission of Sensitive Information",  sensitive information stored on disc has been removed or, if that was not possible, the files have been encrypted with industrial standard encryption methods. In addition, access to sensitive data on disc has been further limited to authorized user accounts. In order to resolve problems noted in "CWE-321: Use of Hard-coded Cryptographic Key", the communication has been altered to industrial standard (SSL/TLS with mutual authentication using client-server certificates) and the offline storage on disc has encrypted as stated in the paragraph above. Due to this change, data (still) encrypted with the hard-coded key can no longer be accessed. Prior Comment: All three reported observations are correct and legitimate. baramundi is going to continually improve in these areas and provides more specific details for these issues enclosed. We have identified two concrete issues with need for immediate action and have addressed and improved these with the new baramundi management suite 2014 (short: bMS 2014). CWE-319: Cleartext Transmission of Sensitive Information - CVE-2013-3593 Baramundi Management Suite versions 7.5 to 8.9 transfers data in clear text between the server and clients, and stores data in clear text. Vendor comment: Due to a protocol problem when negotiating communication channels one side of the communication could be set up unencrypted. bMS 2014 resolves this problem. There are no clear text transfers in this main communication channels any more. In addition the server only accepts encrypted client connections. This change has been implemented compatibly, i.e. even with older agent versions the main communication channel is secured. This improvement also has been implemented for the communication with the agent used with Windows PE for OS installation. This also improves security while installing operating systems. CWE-312: Clear text Storage of Sensitive Information - CVE-2013-3624 When Baramundi Management Suite versions 7.5 to 8.9 is used for OS deployment, it stores the credentials in an unencrypted form on the deployed systems. Vendor comment: This affects the files to configure the OS installation.  Depending on the chosen method to join domains, the administrator credentials can reside in clear text (cf. Microsoft standard methods, http://technet.microsoft.com/en-us/library/cc730845%28v=ws.10%29.aspx#BKMK_3). In the installed system this is part of the Microsoft process to automatically deploy systems. bMS 2014 warns the administrator, if choosing an unsecured method. Access rights regarding OS installation have been further restricted on server side. CWE-321: Use of Hard-coded Cryptographic Key - CVE-2013-3625 Baramundi Management Suite versions 7.5 to 8.9 utilizes a hard-coded encryption key stored in a dll file. Vendor comment: Yes, this is the way it is currently implemented. baramundi will provide continuous improvements in this field. The mobile device management module already uses a certificate based process.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.