[Onapsis Security Advisory 2015-012] SAP Mobile Platform DataVault Predictable Encryption Password for Secure Storage
Onapsis Research Labs <[email protected]> Wed, 12 Aug 2015 11:52:17 -0300
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.bugtraq,gmane.comp.security.penetration,gmane.comp.security.news.securitytracker |
|---|---|
| Organization | Onapsis Inc. |
| Message-ID | <[email protected]> |
Ci0tLS0tQkVHSU4gUEdQIFNJR05FRCBNRVNTQUdFLS0tLS0KSGFzaDogU0hBMQoKT25hcHNpcyBT ZWN1cml0eSBBZHZpc29yeSAyMDE1LTAxMjogU0FQIE1vYmlsZSBQbGF0Zm9ybSBEYXRhVmF1bHQK UHJlZGljdGFibGUgRW5jcnlwdGlvbiBQYXNzd29yZCBmb3IgU2VjdXJlIFN0b3JhZ2UKCgoxLiBJ bXBhY3Qgb24gQnVzaW5lc3MKLSAtLS0tLS0tLS0tLS0tLS0tLS0tLS0KCkJ5IGV4cGxvaXRpbmcg dGhpcyB2dWxuZXJhYmlsaXR5IGFuIGF0dGFja2VyIHdpdGggYWNjZXNzIHRvIGEgdnVsbmVyYWJs ZQptb2JpbGUgZGV2aWNlIHdvdWxkIGJlIGFibGUgdG8gcmVhZCBzZW5zaXRpdmUgaW5mb3JtYXRp b24sIGluY2x1ZGluZwplbmNyeXB0ZWQgbG9nIGluIGNyZWRlbnRpYWxzLCBzdG9yZWQgaW4gdGhl IGRldmljZSwgcG90ZW50aWFsbHkKY29ubmVjdGluZyB0byBidXNpbmVzcyBhcHBsaWNhdGlvbnMg YW5kIGFjY2Vzc2luZyBvciBtb2RpZnlpbmcgYnVzaW5lc3MKaW5mb3JtYXRpb24KClJpc2sgTGV2 ZWw6IEhpZ2gKCjIuQWR2aXNvcnkgSW5mb3JtYXRpb24KLSAtLS0tLS0tLS0tLS0tLS0tLS0tLS0t LQoKICAgICogUHVibGljIFJlbGVhc2UgRGF0ZTogMjAxNS0wOC0xMgogICAgKiBTdWJzY3JpYmVy IE5vdGlmaWNhdGlvbiBEYXRlOiAyMDE1LTA4LTEyCiAgICAqIExhc3QgUmV2aXNlZDogMjAxNS0w OC0xMgogICAgKiBTZWN1cml0eSBBZHZpc29yeSBJRDogT05BUFNJUy0yMDE1LTAxMgogICAgKiBP bmFwc2lzIFNWUyBJRDogT05BUFNJUy0wMDE0OQogICAgKiBDVkU6IE5vdCBBc3NpZ25lZAogICAg KiBSZXNlYXJjaGVyOiBGZXJuYW5kbyBSdXNzCiAgICAqIEluaXRpYWwgQmFzZSBDVlNTIHYyOiAg NC43IChBVjpML0FDOk0vQXU6Ti9DOkMvSTpOL0E6TikKCgozLiBWdWxuZXJhYmlsaXR5IEluZm9y bWF0aW9uCi0gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKICAgICogVmVuZG9yOiAgU0FQ IEFHCiAgICAqIEFmZmVjdGVkIENvbXBvbmVudHM6CsKtICAgICAgKiBTQVAgTW9iaWxlIFBsYXRm b3JtIDMuMCBTUDA1IENsaWVudEh1YgogICAgKiBWdWxuZXJhYmlsaXR5IENsYXNzOiBVc2Ugb2Yg SGFyZC1jb2RlZCBDcnlwdG9ncmFwaGljIEtleSAoQ1dFLTMyMSkKICAgICogUmVtb3RlbHkgRXhw bG9pdGFibGU6IE5vCiAgICAqIExvY2FsbHkgRXhwbG9pdGFibGU6IFllcwogICAgKiBBdXRoZW50 aWNhdGlvbiBSZXF1aXJlZDogTm8KICAgICogT3JpZ2luYWwgQWR2aXNvcnk6Cmh0dHA6Ly93d3cu b25hcHNpcy5jb20vcmVzZWFyY2gvc2VjdXJpdHktYWR2aXNvcmllcy8KCjQuQWZmZWN0ZWQgQ29t cG9uZW50cyBEZXNjcmlwdGlvbgotIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0K ClRoZSBTQVAgTW9iaWxlIFBsYXRmb3JtIDMuMCBTUDUgaGFzIGFuIEFQSSBjYWxsZWQgRGF0YVZh dWx0LCB3aGljaCBpcwp1c2VkIHRvIHNlY3VyZWx5IHN0b3JlIGRhdGEgb24gbW9iaWxlIGRldmlj ZXMuIEFzIGRlc2NyaWJlZCBieSBTQVAgQUcKIlsuLi5dIFRoZSBEYXRhVmF1bHQgQVBJcyBwcm92 aWRlIGEgc2VjdXJlIHdheSB0byBwZXJzaXN0IGFuZCBlbmNyeXB0CmRhdGEgb24gdGhlIGRldmlj ZS4gVGhlIGRhdGEgdmF1bHQgdXNlcyBBRVMtMjU2IHN5bW1ldHJpYyBlbmNyeXB0aW9uIG9mCmFs bCBpdHMgY29udGVudHMuIFRoZSBBRVMga2V5IGlzIGNvbXB1dGVkIGFzIGEgaGFzaCBvZiB0aGUg cGFzc2NvZGUKcHJvdmlkZWQgYW5kIGEg4oCYc2FsdOKAmSB2YWx1ZSB0aGF0IGNhbiBiZSBzdXBw bGllZCBieSB0aGUgZGV2aWNlCmFwcGxpY2F0aW9uIGRldmVsb3Blciwgb3IgYXV0b21hdGljYWxs eSBnZW5lcmF0ZWQgdGhyb3VnaCB0aGUgQVBJIFsuLi5dIgogCjUuVnVsbmVyYWJpbGl0eSBEZXRh aWxzCi0gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCgpUaGUgU0FQIERhdGFWYXVsdCBoYXMgYSBz cGVjaWFsIG1lY2hhbmlzbSB0byBnZW5lcmF0ZSBhIGRlZmF1bHQgc2V0IG9mCmNyZWRlbnRpYWxz IGlmIG5vIHBhc3N3b3JkL3NhbHQgaXMgc3VwcGxpZWQgZHVyaW5nIHRoZSBjcmVhdGlvbiBvZiB0 aGUKc2VjdXJlIHN0b3JhZ2UuCgpJbiB0aGlzIG1vZGUgb2Ygb3BlcmF0aW9uIHRoZSBwYXNzd29y ZC9zYWx0IGlzIGRlcml2ZWQgZnJvbSBhCmNvbWJpbmF0aW9uIG9mIGZpeGVkIHZhbHVlcyBhbmQg dGhlIFZhdWx0SUQgYmVsb25naW5nIHRvIHRoZSBzZWN1cmUgc3RvcmFnZS4KCgo2LlNvbHV0aW9u Ci0gLS0tLS0tLS0tLS0KCkltcGxlbWVudCBTQVAgU2VjdXJpdHkgTm90ZSAyMDk0ODMwLgoKCjcu ICAgIFJlcG9ydCBUaW1lbGluZQogICAgKiAxMS8wNy8yMDE0OiBPbmFwc2lzIHByb3ZpZGVzIHZ1 bG5lcmFiaWxpdHkgaW5mb3JtYXRpb24gdG8gU0FQIEFHLgogICAgKiAxMS8wOC8yMDE0OiBTQVAg QUcgY29uZmlybXMgaGF2aW5nIHJlY2VpdmVkIHRoZSBpbmZvcm1hdGlvbi4KICAgICogMDQvMDgv MjAxNTogU0FQIEFHIHJlbGVhc2VzIFNBUCBzZWN1cml0eSBub3RlIDIwOTQ4MzAgZml4aW5nIHRo ZQp2dWxuZXJhYmlsaXR5CiAgICAqIDA4LzEyLzIwMTU6IFNlY3VyaXR5IEFkdmlzb3J5IGlzIHJl bGVhc2VkLgoKCgpBYm91dCBPbmFwc2lzIFJlc2VhcmNoIExhYnMKLSAtLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0KCk9uYXBzaXMgUmVzZWFyY2ggTGFicyBwcm92aWRlcyB0aGUgaW5kdXN0cnkg YW5hbHlzaXMgb2Yga2V5IHNlY3VyaXR5Cmlzc3VlcyB0aGF0IGltcGFjdCBidXNpbmVzcy1jcml0 aWNhbCBzeXN0ZW1zIGFuZCBhcHBsaWNhdGlvbnMuCkRlbGl2ZXJpbmcgZnJlcXVlbnQgYW5kIHRp bWVseSBzZWN1cml0eSBhbmQgY29tcGxpYW5jZSBhZHZpc29yaWVzIHdpdGgKYXNzb2NpYXRlZCBy aXNrIGxldmVscywgT25hcHNpcyBSZXNlYXJjaCBMYWJzIGNvbWJpbmUgaW4tZGVwdGgga25vd2xl ZGdlCmFuZCBleHBlcmllbmNlIHRvIGRlbGl2ZXIgdGVjaG5pY2FsIGFuZCBidXNpbmVzcy1jb250 ZXh0IHdpdGggc291bmQKc2VjdXJpdHkganVkZ21lbnQgdG8gdGhlIGJyb2FkZXIgaW5mb3JtYXRp b24gc2VjdXJpdHkgY29tbXVuaXR5LgotLS0tLUJFR0lOIFBHUCBTSUdOQVRVUkUtLS0tLQpWZXJz aW9uOiBHbnVQRyB2Mi4wLjIyIChHTlUvTGludXgpCkNvbW1lbnQ6IE9uYXBzaXMgUmVzZWFyY2gg VGVhbQoKaUVZRUFSRUNBQVlGQWxYTFhaOEFDZ2tRejNpNldOVkJjRFhVa0FDZUtWKzc2d2E3SUhu Y3JJSEZ1OUdodEpndQo5a1lBb0xPUU42ckd1VGtxQTRzL1JlQkEvVWdndDZiQwo9aGlWcwotLS0t LUVORCBQR1AgU0lHTkFUVVJFLS0tLS0KCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXwpTZW50IHRocm91Z2ggdGhlIEZ1bGwgRGlzY2xvc3VyZSBtYWlsaW5n IGxpc3QKaHR0cHM6Ly9ubWFwLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Z1bGxkaXNjbG9zdXJlCldl YiBBcmNoaXZlcyAmIFJTUzogaHR0cDovL3NlY2xpc3RzLm9yZy9mdWxsZGlzY2xvc3VyZS8=