exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

nortelVPNpass.txt

nortelVPNpass.txt
Posted Mar 24, 2005
Authored by Roy Hills

NTA Monitor has discovered a password disclosure issue in the Nortel Windows VPN client. The Nortel client stores the password in an obfuscated form in the Windows registry, but it also stores the unencrypted password in process memory.

tags | advisory, registry
systems | windows
SHA-256 | b5520600578557d7becbbed66dbfcd57616c4dd922b9a02a69974e53503b38a9

nortelVPNpass.txt

Change Mirror Download
Nortel VPN Client Issue: Clear-text password stored in memory

Summary:

NTA Monitor have discovered a password disclosure issue in the Nortel
Windows VPN client: The Nortel client stores the password in an obfuscated
form in the Windows registry, but it also stores the unencrypted password
in process memory.

The Nortel VPN client is used for remote access IPsec VPNs, typically in
conjunction with the Nortel Contivity VPN router.

The vendor has been notified of this issue.

Overview:

While performing a VPN security test for a customer, NTA Monitor discovered
that the VPN client that was being used stored the VPN password (pre-shared
key) unencrypted in the memory of the process "Extranet.exe". It was
possible to recover the password by dumping the process memory to a file
with PMDump (http://ntsecurity.nu/toolbox/pmdump/) or by crashing the
system to obtain a physical memory dump with a crash-on-demand utility such
as Bang (http://www.osronline.com/article.cfm?article=153).

Both the user password and group password (if group authentication is being
used) can be determined in this way.

In the memory dump, the plain-text passwords appear near to the associated
user name or group name, which makes them easy to locate. It would be
simple to write a tool to extract the user name, group name and associated
passwords from a memory dump file.

The vulnerability allows anyone with access to the client system to obtain
the password. It may also allow anyone who has access to the obfuscated
password in the client registry to use the VPN client to obtain the
corresponding plain-text password, although this has not been tested.

The issue was found in version 5.01 of the Windows Contivity VPN client,
dated October 2004. It is suspect that earlier versions are also
vulnerable, although this has not been tested. The Linux version of the
Multi-OS client does not appear to be vulnerable, because it does not seem
to allow the password to be saved. Presumably the Multi-OS clients for
other operating systems (MacOS, HP-UX, Etc.) are also not vulnerable.

Further Information:

For further information, including technical details and screenshots, see:

http://www.nta-monitor.com/news/vpn-flaws/nortel/nortel-client/

You may also want to read my recent white paper on common IPsec VPN issues,
which is available at:

http://www.nta-monitor.com/news/vpn-flaws/VPN-Flaws-Whitepaper.pdf

Roy Hills


--
Roy Hills Tel: +44 1634 721855
NTA Monitor Ltd FAX: +44 1634 721844
14 Ashford House, Beaufort Court,
Medway City Estate, Email: Roy.Hills@nta-monitor.com
Rochester, Kent ME2 4FA,
UK WWW: http://www.nta-monitor.com/

Login or Register to add favorites

File Archive:

August 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    15 Files
  • 2
    Aug 2nd
    22 Files
  • 3
    Aug 3rd
    0 Files
  • 4
    Aug 4th
    0 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    11 Files
  • 7
    Aug 7th
    43 Files
  • 8
    Aug 8th
    42 Files
  • 9
    Aug 9th
    36 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close