Nortel VPN Client Issue: Clear-text password stored in memory Summary: NTA Monitor have discovered a password disclosure issue in the Nortel Windows VPN client: The Nortel client stores the password in an obfuscated form in the Windows registry, but it also stores the unencrypted password in process memory. The Nortel VPN client is used for remote access IPsec VPNs, typically in conjunction with the Nortel Contivity VPN router. The vendor has been notified of this issue. Overview: While performing a VPN security test for a customer, NTA Monitor discovered that the VPN client that was being used stored the VPN password (pre-shared key) unencrypted in the memory of the process "Extranet.exe". It was possible to recover the password by dumping the process memory to a file with PMDump (http://ntsecurity.nu/toolbox/pmdump/) or by crashing the system to obtain a physical memory dump with a crash-on-demand utility such as Bang (http://www.osronline.com/article.cfm?article=153). Both the user password and group password (if group authentication is being used) can be determined in this way. In the memory dump, the plain-text passwords appear near to the associated user name or group name, which makes them easy to locate. It would be simple to write a tool to extract the user name, group name and associated passwords from a memory dump file. The vulnerability allows anyone with access to the client system to obtain the password. It may also allow anyone who has access to the obfuscated password in the client registry to use the VPN client to obtain the corresponding plain-text password, although this has not been tested. The issue was found in version 5.01 of the Windows Contivity VPN client, dated October 2004. It is suspect that earlier versions are also vulnerable, although this has not been tested. The Linux version of the Multi-OS client does not appear to be vulnerable, because it does not seem to allow the password to be saved. Presumably the Multi-OS clients for other operating systems (MacOS, HP-UX, Etc.) are also not vulnerable. Further Information: For further information, including technical details and screenshots, see: http://www.nta-monitor.com/news/vpn-flaws/nortel/nortel-client/ You may also want to read my recent white paper on common IPsec VPN issues, which is available at: http://www.nta-monitor.com/news/vpn-flaws/VPN-Flaws-Whitepaper.pdf Roy Hills -- Roy Hills Tel: +44 1634 721855 NTA Monitor Ltd FAX: +44 1634 721844 14 Ashford House, Beaufort Court, Medway City Estate, Email: Roy.Hills@nta-monitor.com Rochester, Kent ME2 4FA, UK WWW: http://www.nta-monitor.com/