NTA Monitor

Latest News

Finance industry faces serious IT security issues

23rd June 2008 The finance industry needs to keep its eye on the small change as well as the bigger picture of its security vulnerabilities Read More

Retail sector faces serious IT security issues

23rd June 2008 The retail sector needs to set out its stall and ring the changes in its security vulnerabilities if it is to avoid the potential for hackers to gain unauthorised system access and disrupt service availability Read More

IT managers have more security headaches to deal with

11th May 2008 NTA Monitor's 2008 Annual Security Report has revealed that the average number of vulnerabilities found per test have increased to 21 compared with 19 in 2007 Read More

Solutions not excuses for patch management warns NTA Monitor

23rd April 2008 Patch management is a vital security requirement for any organsation Read More

Avaya VPNRemote VPN Client Password Disclosure Issue

Summary

NTA Monitor have discovered a password disclosure issue in the Avaya VPNRemote VPN client: VPNRemote stores all user credentials (username and password) in clear-text in the process memory. Such vulnerability was found on August 24, 2005.

This issue occurs regardless of whether the "Save Password" feature is enabled or not.

Overview

NTA Monitor discovered that the VPNRemote client was loading all the credentials unencrypted in the memory of the process "VPNremote.exe". It was possible to recover the password by dumping the process memory to a file with PMDump.

The vulnerability allows anyone with access to the client system to obtain the username and password along with all the other settings required to establish a successful VPN connection. Additionally, this vulnerability could also be exploited by fooling the user to execute malicious code which would dump the memory of the process "VPNremote.exe".

It is also worth mentioning that some times, no direct user interaction is required for the execution of malicious code. Crackers often exploit vulnerabilities in web browsers and email clients that allows them to execute malicious code on the victim's machine without requiring the user to manually execute the trojaned executable. This means that given the right scenario, this vulnerability present in VPNRemote could be exploited in such a way.

Details

After examining the memory dump of the process "VPNremote.exe" with a hexadecimal editor, the username seems to appear 9 different times and the password 2 times. Below is a screenshot of the process memory dump showing the username and password in the clear. In this case the username is "testusername" and the password is "testpass".

Further Information

VPNRemote can be downloaded for free from http://support.avaya.com/vpn/vpnreg.jhtml

This advisory was first released on 23rd November 2005.