Plugin 18405

[Nelson, C.M.]

Plugin 18405 very sensibly generates this report:

"Synopsis : It may be possible to get access to the remote host.
Description : The remote version of Remote Desktop Protocol Server
(Terminal Service) is vulnerable to a man in the middle attack. An
attacker may exploit this flaw to decrypt communications between client
and server and obtain sensitive information (passwords ...)."

When distributing Nessus reports I have to explain that where terminal
services must be enabled then the scope of exposure of the service
should be minimised, probably using the Windows host-based firewall, and
that the accounts exposed should have very strong passwords. This is
because I think remote brute force or dictionary log-in attempts using
e.g. TSgrinder could be more of a concern that the possibility of a
sophisticated man in the middle attack. I'm not sure whether other would
agree, however, it would make my life a little easier if the scope and
password strength aspects could also be explained in the plug-in output.


--
Carl Nelson
Distributed Systems Services, Computer Centre, University of Leicester,
Leicester, LE1 7RH, U.K.
Tel: [phone], Fax: [phone]

[Nicolas Pouvesle]

Post by Nelson, C.M.
"Synopsis : It may be possible to get access to the remote host.
Description : The remote version of Remote Desktop Protocol Server
(Terminal Service) is vulnerable to a man in the middle attack. An
attacker may exploit this flaw to decrypt communications between client
and server and obtain sensitive information (passwords ...)."
When distributing Nessus reports I have to explain that where terminal
services must be enabled then the scope of exposure of the service
should be minimised, probably using the Windows host-based
firewall, and
that the accounts exposed should have very strong passwords. This is
because I think remote brute force or dictionary log-in attempts using
e.g. TSgrinder could be more of a concern that the possibility of a
sophisticated man in the middle attack. I'm not sure whether other would
agree, however, it would make my life a little easier if the scope and
password strength aspects could also be explained in the plug-in output.

This plugin tests that the terminal service is vulnerable to the MiM
attack (by checking the rsa key is fixed) but does not test that the
password is weak. So we can't add that to the plugin output because
it is not linked with the test.


Nicolas

[Steven Adair]

Well, I think the goal is to point out vulnerabilities with the service.
As you point out, it may be possible for someone to bruteforce accounts
through terminal services. However, this isn't really a vulnerability.
The results of Nessus do you make you aware that TS is reachable by the
scanner. Your lock out policy, account passwords, and any other number of
things can come into play. That's not what Nessus wants to inform you of.
Otherwise you'd get a lecture for any service that accepts credentials
(SSH, mySQL, Oracle, Web Admin directories, htaccess protected folder,
ftp, etc.).

The scanner is pointing out that the server is suceptible to a MITM attack
that can let an attacker grab all your traffic destined to TS server and
read as it RC4 wasn't applied. The link in the report should be there and
point to http://www.oxid.it/downloads/rdp-gbu.pdf. This does a pretty
good job of explaining the vulnerability and the risks.

Alternatively, if you are looking to protect yourself better. You can
setup firewall ACLs or use IPSec (with ACLs if you want). There's a
number of things you can do to minimize the risk..to include eliminating
it by terming off TS. ;)

Hope that helps.

Steven
securityzone.org

Post by Nelson, C.M.
"Synopsis : It may be possible to get access to the remote host.
Description : The remote version of Remote Desktop Protocol Server
(Terminal Service) is vulnerable to a man in the middle attack. An
attacker may exploit this flaw to decrypt communications between client
and server and obtain sensitive information (passwords ...)."
When distributing Nessus reports I have to explain that where terminal
services must be enabled then the scope of exposure of the service
should be minimised, probably using the Windows host-based firewall, and
that the accounts exposed should have very strong passwords. This is
because I think remote brute force or dictionary log-in attempts using
e.g. TSgrinder could be more of a concern that the possibility of a
sophisticated man in the middle attack. I'm not sure whether other would
agree, however, it would make my life a little easier if the scope and
password strength aspects could also be explained in the plug-in output.
--
Carl Nelson
Distributed Systems Services, Computer Centre, University of Leicester,
Leicester, LE1 7RH, U.K.
Tel: [phone], Fax: [phone]
_______________________________________________
Nessus mailing list
http://mail.nessus.org/mailman/listinfo/nessus