ax09001h has reported a design error in DameWare Mini Remote Control and NT Utilities, possibly allowing malicious people to gain knowledge of the encryption key.

The problem is that the Blowfish encryption key is transmitted in plaintext when transferring files. This effectively allows anyone, who can sniff traffic, to decrypt the encrypted data.

Also, the random function is reportedly weak. The random generator isn't truely random and may allow malicious people to enumerate or predict the encryption key.

The issues affect 3.x versions prior to 3.74 and 4.x versions prior to 4.2.

Solution
Update to version 3.74 or 4.2.
Further details available to Secunia VIM customers

Provided and/or discovered by
ax09001h

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.dameware.com/support/security/bulletin.asp?ID=SB3

Deep Links
Links available to Secunia VIM customers