Today, we published two advisories about weaknesses in the SAMwin Center Suite and SAMwin Agent of Telecommunication Software GmbH, a SIP based call-center solution.
The first issue is a very basic weakness in the architecture of
the software: Hard-coded passwords, which allow anyone to directly
connect to back-end database servers of any deployment. This is
pretty bad, as not only user-accounts and passwords are stored in
this database, but also details and configuration regarding
call-forwarding etc. All access credentials can be extracted from
the executable files of the software installation.
Details about this can be found in our security advisory
MZ-13-06_SAMwin_Architectural_Issues.txt.
The second advisory details weaknesses in the propriatary
password-hashing algorithm.
The employed algorithm has unfavorable statistical properties and
is prone to collisions:
It is possible to create a sequence of password candidates to
optimally cover the space of possible hash values. With 3000
guesses in this sequence, an attacker will successfully gain access
with a probability of 99.9%. And with 5743 guesses he is able to
cover the whole space of possible hash values and succeed with
certainty.
All details and backgrounds about this issue can be found in our
security advisory
MZ-13-07_SAMwin_Collisions.txt.
Credits:
References: