full-disclosure - Re: Terminal Server vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <s625ij21f4gmp8t.250120051212@shayndel>
From: larry at larryseltzer.com (Larry Seltzer)
Subject: Re:  Terminal Server vulnerabilities

Yeah, fine, so if this bothers you use a VPN. I still it's something
very few people need to worry about.	

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer@...fdavis.com 
-----Original Message-----
From: full-disclosure-bounces@...ts.netsys.com
[mailto:full-disclosure-bounces@...ts.netsys.com] On Behalf Of Mark
Senior
Sent: Tuesday, January 25, 2005 12:00 PM
To: full-disclosure@...ts.netsys.com
Subject: RE: [Full-Disclosure] Re: Terminal Server vulnerabilities

Terminal Server encrypts its traffic, yes, but it doesn't do any
verification of what server it's connecting to.  This is equivalent to
SSL with anonymous DH key agreement - you know no eavesdroppers can
listen in, but you have no idea who you're talking to.

So a MiTM attack is possible, there is no difficulty decrypting the
traffic - you just make the entire session terminate at the attacking
end, and make a new session to the real server.  Yes, most of the
keypresses would be uninteresting information, but there are a few right
at the start, typically between a TAB and an ENTER, that might be of
some interest...

The annoying thing is, the server does actually have a persistent key,
which the client could verify from one connection to the next - it just
doesn't; it throws the key away after the connection is established.
It's not unfixable; fixing it wouldn't even break the existing protocol.
The client would just have to behave like an ssh client, and check its
known keys.

-----Original Message-----
From: full-disclosure-bounces@...ts.netsys.com
[mailto:full-disclosure-bounces@...ts.netsys.com] On Behalf Of Larry
Seltzer
Sent: January 25, 2005 04:27
To: 'Daniel H. Renner'; full-disclosure@...ts.netsys.com
Subject: RE: [Full-Disclosure] Re: Terminal Server vulnerabilities

>>> [MS] claim there are no
>>> unfixed vulnerabilities to Terminal Server on Windows Server 2000 
>>> Service Pack 4.
>>> 
>>> I find that hard to believe and I know you guys will know if they
are 
>>> full of it, or they are correct. Please let me know ASAP of any 
>>> CURRENT vulnerabilities int Terminal Server.

>>Try here for starters:
>>http://www.google.com/search?q=%22windows+terminal+server%22+exploit&s
ourceid=mozilla&start=0&start=0&ie=utf-8&oe=utf-8
>>(2,310 results)

Just as I figured. Based only on the first 25 or so, all of the real
exploits discussed are patched and the vast majority of them apply to
Windows NT 4.0 Terminal Server. The original poster asked about
"CURRENT" vulnerabilities.

The one remaining issue I remembered is on this page
(http://www.saintcorporation.com/cgi-bin/demo_tut.pl?tutorial_name=Micro
soft_Terminal_Server.html&fact_color=doc&tag=), which is also a good
collection of vulnerabilities in general. It is a man-in-the-middle
attack that could allow an attacker, using a collection of techniques
including IP spoofing, to recover the original plaintext session. RDP,
the Terminal Server protocol, is encrypted by default. The worst thing
you have to do to work around this is to use a VPN, but considering what
they would recover is RDP data (mouse moves, key clicks, GDI elements,
etc.) I consider this a relatively high-overhead attack. 

Your Windows Terminal Server is much more likely to be vulnernerable to
a problem in Windows than one specifically in Terminal Server, which has
a very good security history. 

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer@...fdavis.com 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they are
addressed. If you have received this email in error please notify the
system manager. This message contains confidential information and is
intended only for the individual named. If you are not the named
addressee you should not disseminate, distribute or copy this e-mail.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html