aVirt Gateway Suite RAS Password Vulnerability
BID:607
Info
aVirt Gateway Suite RAS Password Vulnerability
| Bugtraq ID: | 607 |
| Class: | Unknown |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Aug 24 1999 12:00AM |
| Updated: | Aug 24 1999 12:00AM |
| Credit: | This vulnerability was posted to the bugtraq-es mailing list by Jesús López de Aguileta <[email protected]> on 8/24/99. |
| Vulnerable: |
Avirt Gateway Suite 3.5 Avirt Gateway Suite 3.3 |
| Not Vulnerable: | |
Discussion
aVirt Gateway Suite RAS Password Vulnerability
aVirt's Gateway Suite (consisting of aVirt Gateway Server and aVirt Mail Server) allows Microsoft hosts to serve as a gateway access point to remote networks. For dial-up connections to the remote network, the aVirt administrator may configure the aVirt product to dial an existing RAS connection. The RAS username and password must be entered into the aVirt interface (the password is obfuscated with stars). The cleartext password may be obtained by any user with local access to the aVirt product.
aVirt's Gateway Suite (consisting of aVirt Gateway Server and aVirt Mail Server) allows Microsoft hosts to serve as a gateway access point to remote networks. For dial-up connections to the remote network, the aVirt administrator may configure the aVirt product to dial an existing RAS connection. The RAS username and password must be entered into the aVirt interface (the password is obfuscated with stars). The cleartext password may be obtained by any user with local access to the aVirt product.
Exploit / POC
aVirt Gateway Suite RAS Password Vulnerability
Two mechanisms may be used to obtain the RAS password stored in the aVirt interface:
1) Use Snadboy's Revelation tool http://www.securityfocus.com/templates/tools_category.html?category=9&path=[%20recovery%20][%20passwords%20] to view the cleartext password, or
2) Select the 'Properties' tab of the aVirt product. Select 'Internet Connection'. Modify the 'username' entry with a bogus username. Click the 'Test' button. aVirt will attempt to establish the RAS connection. Upon failure to connect (due to the incorrect username) the user will be presented with a popup window displaying the cleartext password stored for the RAS connection.
Two mechanisms may be used to obtain the RAS password stored in the aVirt interface:
1) Use Snadboy's Revelation tool http://www.securityfocus.com/templates/tools_category.html?category=9&path=[%20recovery%20][%20passwords%20] to view the cleartext password, or
2) Select the 'Properties' tab of the aVirt product. Select 'Internet Connection'. Modify the 'username' entry with a bogus username. Click the 'Test' button. aVirt will attempt to establish the RAS connection. Upon failure to connect (due to the incorrect username) the user will be presented with a popup window displaying the cleartext password stored for the RAS connection.