full-disclosure - Nortel VPN Client Issue: Clear-text password stored in memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <6.1.2.0.0.20050322203159.0212ac20@mail.u-net.com>
From: Roy.Hills at nta-monitor.com (Roy Hills)
Subject: Nortel VPN Client Issue: Clear-text password
	stored in memory

Nortel VPN Client Issue: Clear-text password stored in memory

Summary:

NTA Monitor have discovered a password disclosure issue in the Nortel
Windows VPN client:  The Nortel client stores the password in an obfuscated
form in the Windows registry, but it also stores the unencrypted password
in process memory.

The Nortel VPN client is used for remote access IPsec VPNs, typically in
conjunction with the Nortel contivity VPN router.

The vendor has been notified of this issue.

Overview:

While performing a VPN security test for a customer, NTA Monitor discovered
that the VPN client that was being used stored the VPN password (pre-shared
key) unencrypted in the memory of the process "Extranet.exe".  It was
possible to recover the password by dumping the process memory to a file
with PMDump (http://ntsecurity.nu/toolbox/pmdump/) or by crashing the
system to obtain a physical memory dump with a crash-on-demand utility such
as Bang (http://www.osronline.com/article.cfm?article=153).

Both the user password and group password (if group authentication is being
used) can be determined in this way.

In the memory dump, the plain-text passwords appear near to the associated
user name or group name, which makes them easy to locate.  It would be
simple to write a tool to extract the user name, group name and associated
passwords from a memory dump file.

The vulnerability allows anyone with access to the client system to obtain
the password.  It may also allow anyone who has access to the obfuscated
password in the client registry to use the VPN client to obtain the
corresponding plain-text password, although this has not been tested.

The issue was found in version 5.01 of the Windows Contivity VPN client,
dated October 2004.  It is suspect that earlier versions are also
vulnerable, although this has not been tested.  The Linux version of the
Multi-OS client does not appear to be vulnerable, because it does not seem
to allow the password to be saved.  Presumably the Multi-OS clients for
other operating systems (MacOS, HP-UX, Etc.) are also not vulnerable.

Further Information:

For further information, including technical details and screenshots, see:

http://www.nta-monitor.com/news/vpn-flaws/nortel/nortel-client/

You may also want to read my recent white paper on common IPsec VPN issues,
which is available at:

http://www.nta-monitor.com/news/vpn-flaws/VPN-Flaws-Whitepaper.pdf

Roy Hills

--
Roy Hills                                    Tel:   +44 1634 721855
NTA Monitor Ltd                              FAX:   +44 1634 721844
14 Ashford House, Beaufort Court,
Medway City Estate,                          Email: Roy.Hills@...-monitor.com
Rochester, Kent ME2 4FA,
UK                  WWW:   http://www.nta-monitor.com/