|
Brought to you by:
Suppliers of:
|
|
|
| |
"The Nortel VPN Client provides user-side functionality for secure remote access over IP networks using Nortel VPN routers and VPN servers. Nortel VPN Client software works on virtually all user workstations access platforms, including Windows 2000, NT, ME, XP, Mobile (Pocket PC), IBM-AIX, SUN-Solaris, Linux and Macintosh operating systems."
Nortel VPN Client stores user and group passwords unencrypted in local memory, this makes it easy to retrieve them by simply dumping the memory of the VPN client. |
| |
Credit:
The information has been provided by Roy Hills.
The original article can be found at: http://www.nta-monitor.com/news/vpn-flaws/nortel/nortel-client/
|
| |
Vulnerable Systems:
* Windows Contivity VPN client version 5.01.
While performing a VPN security test for a customer, NTA Monitor discovered that the VPN client that was being used stored the VPN password (pre-shared key) unencrypted in the memory of the process "Extranet.exe". It was possible to recover the password by dumping the process memory to a file with PMDump or by crashing the system to obtain a physical memory dump with a crash-on-demand utility such as Bang.
Both the user password and group password (if group authentication is being used) can be determined in this way. In the memory dump, the plain-text passwords appear near to the associated user name or group name, which makes them easy to locate. It would be simple to write a tool to extract the user name, group name and associated passwords from a memory dump file.
The vulnerability allows anyone with access to the client system to obtain the password. It may also allow anyone who has access to the obfuscated password in the client registry to use the VPN client to obtain the corresponding plain-text password, although this has not been tested.
|
|
|
|
|
