Avaya Nortel Enterprise Response to VU261869 User Manual

>TECHNICAL SUPPORT

. SECURITY ADVISORY BULLETIN

Nortel Enterprise Response to VU#261869: Clientless SSL VPN Security Issue

Source:

US-CERT Vulnerability Note on the Clientless SSL VPN Security Issues at: http://www.kb.cert.org/vuls/id/261869 CVE-2009-2631 at:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2631

CERT- Coordination Center CA-200-02 is available at:

http://www.cert.org/advisories/CA-2000-02.html#impact

BULLETIN ID: 2009009920, Rev 1

PUBLISHED: 2009-12-15

STATUS: Active REGION: All

PRIORITY: Critical

TYPE: Security Advisory

Overview:

Clientless SSL VPN products from multiple vendors operate in a way that breaks fundamental browser security mechanisms. An attacker could use these devices to bypass authentication or conduct other web-based attacks.

By convincing a user to view a specially crafted web page, a remote attacker may be able to obtain VPN session tokens and read or modify content (including cookies, script, or HTML content) from any site accessed through the clientless SSL VPN. This effectively eliminates same origin policy restrictions in all browsers. Because all content runs at the privilege level of the web VPN domain, mechanisms to provide domain-based content restrictions, such as Internet Explorer security zones and the Firefox add-on NoScript, may be bypassed. For example, the attacker may be able to capture keystrokes while a user is interacting with a web page. For additional information about impacts, please review CERT Advisory CA-2000-02.

There is no solution to this problem. Depending on their specific configuration and location in the network these devices may be impossible to operate securely. Administrators are encouraged to view the workarounds detailed in the Solutions section of the US-CERT Vulnerability Note for the following:

1. Limit URL rewriting to trusted domains

2. Block the VPN server from accessing untrusted domains

3. Disable URL hiding features

Before taking any action please ensure that you are viewing the latest official version of this security advisory by referencing http://www.nortel.com/securityadvisories

For more information: Please contact your next level of support or visit http://www.nortel.com/contact for support numbers within your region. Nortel security advisories: http://nortel.com/securityadvisories Nortel Partner Information Center (PIC) website: http://www.nortelnetworks.com/pic

NORTEL ENTERPRISERESPONSE TO VU#261869: CLIENTLESS SSL VPN SECURITY ISSUE 2009009920, REV 1

Symptoms:

Please refer to the Resolution section herein for product-specific information from Nortel.

Prevention:

Please refer to the Resolution section herein for product-specific information from Nortel.

Mitigation:

Please refer to the US-CERT link in the Source section for mitigation information for the various vulnerabilities addressed by the US-CERT advisory. Please refer to the Resolution section herein for product-specific information from Nortel.

Risk:

Please refer to the US-CERT link in the Source section for additional information about the risks of the various vulnerabilities addressed by the US-CERT advisory. Please refer to the Resolution section of this bulletin for product-specific information from Nortel.

Resolution:

1) The following Nortel Generally Available products are potentially vulnerable to the security issue outlined in the US-CERT Advisory for Clientless SSL VPN Security Issues. Please refer to product-specific text below for instructions on how to proceed.

CallPilot - 201i, 202i, 600r, 703t, 1002rp, 1005r

. Customers should avoid browsing other web sites while logged in securely to CallPilot Manager or My CallPilot.

2) The following Nortel Generally Available products are not vulnerable to the security issue outlined in the US-CERT Advisory for Clientless SSL VPN Security Issues. Please refer to product-specific information below for any further instructions.

BCM - BCM50, BCM200, BCM400, BCM450, BCM1000, SRG50, SRG200, SRG400

. The BCM and BCM-based SRG is not impacted by Clientless SSL VPN products that break web browser's

domain-based security models issue, as the BCM / SRG models do not have a clientless SSL VPN solution. Contact Center - CCT