CVE-1999-1049: Weak Encryption
ARCserve NT agents use weak encryption (XOR) for passwords, which allows remote attackers to sniff the authentication request to port 6050 and decrypt the password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Broadcom BrightStor ARCserve Backup (ARCserve NT agent)from your environment.Uninstall or disable the ARCserve NT agent on systems where the agent is not required to eliminate use of the weak XOR-based password encryption.
- Compensating control
Block or restrict network access to TCP port 6050 at the network perimeter and internal firewalls/ACLs. Allow access only from trusted management hosts that require connectivity to the ARCserve NT agent.
- Operational
Assume passwords exposed via the ARCserve NT agent may have been compromised; rotate/change any credentials used by ARCserve agents and related accounts.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1049?
CVE-1999-1049 has a moderate severity level due to its potential to expose plaintext passwords.
How do I fix CVE-1999-1049?
To fix CVE-1999-1049, upgrade to a version of CA BrightStor ARCserve Backup higher than 6.5 that utilizes stronger encryption methods.
Which versions of ARCserve Backup are affected by CVE-1999-1049?
CVE-1999-1049 affects all versions of CA BrightStor ARCserve Backup up to and including version 6.5.
What type of encryption vulnerability is identified in CVE-1999-1049?
CVE-1999-1049 identifies a vulnerability due to the use of weak XOR encryption for passwords.
What can attackers do with the vulnerability CVE-1999-1049?
Attackers can potentially sniff authentication requests to port 6050 and decrypt the weakly encrypted passwords.