CVE-2006-0363 in MSN Messenger
Summary
by MITRE
The "Remember my Password" feature in MSN Messenger 7.5 stores passwords in an encrypted format under the HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds registry key, which might allow local users to obtain the original passwords via a program that calls CryptUnprotectData, as demonstrated by the "MSN Password Recovery.exe" program. NOTE: it could be argued that local-only password recovery is inherently insecure because the decryption methods and keys must be stored somewhere on the local system, and are thus inherently accessible with varying degrees of effort. Perhaps this issue should not be included in CVE.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2017
The vulnerability described in CVE-2006-0363 represents a critical security flaw in MSN Messenger 7.5's password storage mechanism that fundamentally undermines the security of user credentials. This issue stems from the application's implementation of a "Remember my Password" feature that, despite claiming to encrypt passwords, actually stores them in a manner that is inherently susceptible to local privilege escalation attacks. The passwords are persisted in the Windows registry at the specific location HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds, which creates a predictable and accessible storage point for malicious actors.
The technical flaw exploited in this vulnerability resides in the application's improper handling of cryptographic operations within the Windows operating system. When MSN Messenger 7.5 encrypts passwords using the Windows CryptoAPI functions, it relies on the CryptProtectData and CryptUnprotectData functions to secure user credentials. However, the implementation fails to properly isolate the encryption keys from the decryption process, creating a scenario where local users can access the same cryptographic functions that the application uses to store passwords. The vulnerability becomes particularly pronounced when third-party tools such as "MSN Password Recovery.exe" are employed, which leverage the same CryptUnprotectData API calls that the legitimate application uses, thereby enabling unauthorized password recovery without requiring any special privileges or complex attack vectors.
The operational impact of this vulnerability extends far beyond simple credential theft, as it represents a fundamental architectural weakness in how the application approaches password security. Local users who gain access to the system can trivially recover passwords for multiple MSN Messenger accounts, potentially enabling them to access other services that might use similar credentials, leading to broader account compromise and potential identity theft. This vulnerability also demonstrates the broader issue of insufficient separation between application-level security mechanisms and system-level cryptographic functions, creating an attack surface that adversaries can exploit through legitimate system APIs. The weakness affects all local users with access to the system, regardless of their administrative privileges, making it particularly dangerous in shared or multi-user environments where password recovery tools might be readily available.
This vulnerability aligns with several established security frameworks and threat models, including CWE-310, which addresses cryptographic weakness in data protection mechanisms, and represents a classic example of insufficient key separation in cryptographic implementations. From an ATT&CK perspective, this issue maps to T1555.003, which covers credential access through the use of stolen credentials, and T1068, which involves local privilege escalation through application vulnerabilities. The security implications also relate to the broader concept of privilege escalation and the principle of least privilege, as the vulnerability allows local users to bypass the application's intended security controls. The flaw exemplifies how applications that attempt to provide convenience features such as password persistence often inadvertently create security vulnerabilities when they fail to properly isolate their cryptographic operations from the local user environment.
The recommended mitigations for this vulnerability focus on both immediate remediation and long-term architectural improvements. The most effective immediate solution involves disabling the "Remember my Password" feature within MSN Messenger 7.5 and implementing stronger password management practices such as regular password rotation and the use of unique credentials for different services. Organizations should also consider implementing additional security controls such as registry access monitoring and user behavior analytics to detect unauthorized access attempts to sensitive registry locations. The underlying architectural issue requires a fundamental redesign of how applications handle password storage, emphasizing the use of secure credential storage mechanisms such as Windows Credential Manager or secure key storage solutions that properly separate encryption keys from the processes that access them. Additionally, system administrators should ensure that all Microsoft applications are kept up to date with security patches and that legacy applications with known vulnerabilities are either patched or deprecated from production environments to prevent exploitation by malicious actors.