GFI Languard Network Security Scanner 5.0 Insecure Credential Storage Vulnerability

Critical Vulnerability Information Vulnerability Name: GFI L.N.S.S 5.0 - Insecure Credential Storage Product: GFI Languard Network Security Scanner Version: 5.0 Release Date: February 28, 2005 Vulnerability Type: Insecure Credential Storage Overview: - GFI L.N.S.S is a vulnerability scanner that helps administrators identify security weaknesses in network systems, featuring an integrated patch management solution. - Users can provide credentials to remotely deploy patches. - The identified weakness allows immediate recovery of stored credentials without requiring offline attacks; domain usernames and passwords are stored in plaintext in this case. Issue Description: - Each time the L.N.S.S process (lnss.exe) is loaded to perform scanning or deployment tasks, saved credentials can be immediately read from the process memory space, as usernames and passwords are stored in plaintext. - Attackers can easily dump plaintext MS-SQL and DOMAIN usernames/passwords using simple code. Exploitation Method: - Use custom memory dumping code or provided tools to dump the process memory space. - "Process Memory Dumper" code provided by KD-TEAM can be customized to accomplish the task. Vendor Response: - The vendor has acknowledged the issue but has not yet released a patch or workaround. Temporary Mitigation: - Avoid running the LNSS process on low-privilege accounts (GFI defaults to running as SYSTEM). - Do not save passwords (for domain accounts used during scanning). - Attempt to avoid using "Alternative Credentials" mode. Discoverer: Seyed Hamid Kashfi (hamid@hat-squad.com)

Goal Reached Thanks to every supporter — we hit 100%!

GFI Languard Network Security Scanner 5.0 Insecure Credential Storage Vulnerability