Nortel VPN Client Issue: Clear-text password stored in memory

Summary:

NTA Monitor have discovered a password disclosure issue in the Nortel 
Windows VPN client:  The Nortel client stores the password in an obfuscated 
form in the Windows registry, but it also stores the unencrypted password 
in process memory.

The Nortel VPN client is used for remote access IPsec VPNs, typically in 
conjunction with the Nortel Contivity VPN router.

The vendor has been notified of this issue.

Overview:

While performing a VPN security test for a customer, NTA Monitor discovered 
that the VPN client that was being used stored the VPN password (pre-shared 
key) unencrypted in the memory of the process "Extranet.exe".  It was 
possible to recover the password by dumping the process memory to a file 
with PMDump (http://ntsecurity.nu/toolbox/pmdump/) or by crashing the 
system to obtain a physical memory dump with a crash-on-demand utility such 
as Bang (http://www.osronline.com/article.cfm?article=153).

Both the user password and group password (if group authentication is being 
used) can be determined in this way.

In the memory dump, the plain-text passwords appear near to the associated 
user name or group name, which makes them easy to locate.  It would be 
simple to write a tool to extract the user name, group name and associated 
passwords from a memory dump file.

The vulnerability allows anyone with access to the client system to obtain 
the password.  It may also allow anyone who has access to the obfuscated 
password in the client registry to use the VPN client to obtain the 
corresponding plain-text password, although this has not been tested.

The issue was found in version 5.01 of the Windows Contivity VPN client, 
dated October 2004.  It is suspect that earlier versions are also 
vulnerable, although this has not been tested.  The Linux version of the 
Multi-OS client does not appear to be vulnerable, because it does not seem 
to allow the password to be saved.  Presumably the Multi-OS clients for 
other operating systems (MacOS, HP-UX, Etc.) are also not vulnerable.

Further Information:

For further information, including technical details and screenshots, see:

http://www.nta-monitor.com/news/vpn-flaws/nortel/nortel-client/

You may also want to read my recent white paper on common IPsec VPN issues, 
which is available at:

http://www.nta-monitor.com/news/vpn-flaws/VPN-Flaws-Whitepaper.pdf

Roy Hills


--
Roy Hills                                    Tel:   +44 1634 721855
NTA Monitor Ltd                              FAX:   +44 1634 721844
14 Ashford House, Beaufort Court,
Medway City Estate,                          Email: Roy.Hills@nta-monitor.com
Rochester, Kent ME2 4FA, 
UK                  WWW:   http://www.nta-monitor.com/