ID

VAR-200905-0262

CVE

CVE-2009-1473

TITLE

ATEN KH1516i IP KVM Switch Windows Vulnerability in a client program that could allow man-in-the-middle attacks

DESCRIPTION

The (1) Windows and (2) Java client programs for the ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 do not properly use RSA cryptography for a symmetric session-key negotiation, which makes it easier for remote attackers to (a) decrypt network traffic, or (b) conduct man-in-the-middle attacks, by repeating unspecified "client-side calculations.". RSA Vulnerability exists in decrypting network traffic or performing man-in-the-middle attacks due to improper use of cryptography.By a third party " Client-side calculation " Can be used to decrypt network traffic or perform man-in-the-middle attacks. Multiple ATEN IP KVM switches are prone to multiple remote vulnerabilities and a weakness: - A security weakness may allow attackers to decrypt HTTP traffic. - A remote code-execution vulnerability is present. - A security vulnerability may allow attackers to gain access to the session key. - A security vulnerability may allow attackers to gain access to mouse events. - A security vulnerability may allow attackers to gain access to the session ID. Attackers can exploit these issues to execute Java code, compromise and gain unauthorized access to the affected device connected to the KVM, gain access to the session key, and gain access to the session ID. Other attacks are also possible. IP KVM is a series of switch equipment developed by Taiwan Acer Technology Co., Ltd. This key agreement uses RSA in an insecure way, an attacker who can monitor the communication between the client and the switch can repeat the client's calculations and obtain the session key, and then use this key to decrypt the communication and reconstruct keystrokes, or Perform man-in-the-middle attacks to gain access to machines connected to the switch. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: ATEN KH1516i / KN9116 Multiple Vulnerabilities SECUNIA ADVISORY ID: SA35241 VERIFY ADVISORY: http://secunia.com/advisories/35241/ DESCRIPTION: Some vulnerabilities have been reported in ATEN KH1516i and KN9116, which can be exploited by malicious people to disclose sensitive information, manipulate certain data, and potentially compromise a user's system. 1) An error exists in the key exchange process when negotiating a symmetric session key via RSA. This can be exploited extract the session key by intercepting traffic and e.g. potentially execute arbitrary code on connected machines via MitM (Man-in-the-Middle) attacks. 2) Mouse events are transferred between a client and the KVM switch via an unencrypted data channel. This can be exploited to inject e.g. arbitrary mouse clicks via MitM (Man-in-the-Middle) attacks. 3) The web interface session cookie does not contain the "Secure" attribute. This can be exploited to obtain the cookie and potentially gain access to connected machines by redirecting the user's browser to a HTTP connection. The vulnerabilities are reported in KH1516i and KN9116. Other products may also be affected. SOLUTION: Use the products in trusted networks only. PROVIDED AND/OR DISCOVERED BY: Jakob Lell from the TU Berlin computer security working group ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

encryption problem

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Jakob Lell jakob@cs.tu-berlin.de

SOURCES

LAST UPDATE DATE

2025-04-10T23:05:08.804000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE