Mozilla Thunderbird SMTP down-negotiation weakness

[Thomas Henlich]

MOZILLA THUNDERBIRD SMTP DOWN-NEGOTIATION WEAKNESS

Thomas Henlich <thomas@henlich.de>

SUMMARY

Mozilla Thunderbird SMTP down-negotiation behaviour allows a man-
in-the-middle (MITM) attack to bypass TLS initialization and/or
downgrade CRAM-MD5 to PLAIN authentication, leading to exposure
of authentication information. Failure in CRAM-MD5 authentication
also leads to exposure of authentication information to a passive
eavesdropper.

BACKGROUND

Mozilla Thunderbird is a mail user agent with support for SMTP
PLAIN and CRAM-MD5 authentication and for secure SMTP over TLS.

CRAM-MD5 is a method for secure user authentication which avoids
plaintext transmission of sensitive information (account/
password). TLS is a security protocol to protect transmitted data
against eavesdropping.

AFFECTED VERSIONS

- Mozilla Thunderbird 1.0.7 (20050923)
- Mozilla Thunderbird 1.5 Beta 2 (20051006)
- possibly other programs using the Mozilla mail component

DESCRIPTION

The SMTP negotiation in Mozilla Thunderbird is implemented in a
way that if a secure data exchange (CRAM-MD5 or STARTTLS) between
client and server can not be established, an insecure method is
used instead. The user is not notified of this and can not cancel
this insecure data exchange. An intermediate attacker can utilize
this behaviour to gain sensitive account/password information. As
CRAM-MD5 and TLS were designed to avoid eavesdropping attacks,
currently the implementation of Mozilla's SMTP client fails to
meet these design goals. Several methods of attack are possible:

A1. Passive eavesdropping attack on CRAM-MD5 authentication
failure

Scenario

- Client (C) Mozilla Thunderbird
- SMTP server (S) which supports and advertises PLAIN and CRAM-
MD5 authentication
- Attacker A1 who can read network traffic from C to S

Sequence of attack

- User accidentally mistypes password (e.g. "secrez" instead
"secret").
- C tries CRAM-MD5 authentication which fails.
- C retries with PLAIN authentication.
- A1 can guess the correct password from sniffed connection.

A2. One-way active MITM attack on CRAM-MD5 capability
advertisement

Scenario

- Client (C) Mozilla Thunderbird
- SMTP server (S) which supports and advertises PLAIN and CRAM-
MD5 authentication.
- Attacker A2 who can read network traffic from C to S and modify
network traffic from S to C

Sequence of attack

- S sends EHLO response.
- A2 discards S's SMTP authentication advertisement and sends
"AUTH PLAIN" advertisement to C.
- C connects with PLAIN authentication.
- A2 can read cleartext password.

A3. One-way active MITM attack on CRAM-MD5 authentication attempt

Scenario

- Client (C) Mozilla Thunderbird
- SMTP server (S) which supports and advertises PLAIN and CRAM-
MD5 authentication.
- Attacker A3 who can read and modify network traffic from C to S

Sequence of attack

- S sends CRAM-MD5 challenge to C.
- C sends authentication, but A3 transmits a different (random)
response causing authentication to fail.
- C reauthenticates with PLAIN authentication.
- A3 can read cleartext password.

A4. One-way active MITM attack on STARTTLS capability
advertisement

Scenario

- Client (C) Mozilla Thunderbird
- SMTP server which supports and advertises STARTTLS
- Attacker A4 who can read network traffic from C to S and modify
network traffic from S to C

Sequence of attack

- S sends EHLO response with STARTTLS advertisement.
- A4 discards S's STARTTLS advertisement.
- PLAIN authentication takes place.
- A4 can read cleartext password.

RESOLUTION

For A1-A3 no resolution is known. For A4, set user preference to
enforce TLS.

PROOF OF CONCEPT

A TCP proxy application demonstrating these weaknesses is
available from http://www.henlich.de/moz-smtp/stcppipe-x.zip

TIMELINE

- 2005-10-08: Opened Bugzilla Bug 311657
- 2005-10-11: Reported to security@mozilla.org

[Jason Haar]

Thomas Henlich wrote:

>Sequence of attack
>
>- S sends EHLO response with STARTTLS advertisement.
>- A4 discards S's STARTTLS advertisement.
>- PLAIN authentication takes place.
>- A4 can read cleartext password.
>
>RESOLUTION
>
>For A1-A3 no resolution is known. For A4, set user preference to
>enforce TLS.
>
>
>
Comment about A4.

Thunderbird explicitly allows you "TLS, if available" - which appears to
be what you refer to. However, there is a "TLS" - which means only do
TLS - and alert if the TLS certificate presented doesn't match a known
one (which would happen in a MITM).

Are you referring to a bug in their "TLS" mode - or implying that "TLS,
if available" is somehow not... what it says it is...???

Doesn't sound like a hole to me.

--
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

[Tony Finch]

Jason Haar <Jason.Haar@trimble.co.nz> wrote:
>
>Thunderbird explicitly allows you "TLS, if available" - which appears to
>be what you refer to. However, there is a "TLS" - which means only do
>TLS - and alert if the TLS certificate presented doesn't match a known
>one (which would happen in a MITM).
>
>Are you referring to a bug in their "TLS" mode - or implying that "TLS,
>if available" is somehow not... what it says it is...???
>
>Doesn't sound like a hole to me.

The "TLS, if available" option is common to most MUAs and is a serious
security problem.

Thunderbird has other security-related user interface problems. For
example, the account setup wizard creates accounts with insecure
settings by default and then encourages users to log in immediately
and compromise their passwords.

http://www.livejournal.com/users/fanf/39428.html

Tony.
--
f.a.n.finch <dot@dotat.at> http://dotat.at/
LOUGH FOYLE TO CARLINGFORD LOUGH: SOUTHWEST 4 OR 5 INCREASING 6 OR 7 FOR A
TIME WEATHER: SHOWERS DYING OUT, RAIN LATER VISIBILITY: MODERATE OR GOOD.
MODERATE, BECOMING ROUGH IN NORTH

[Bob Beck]

>
> The "TLS, if available" option is common to most MUAs and is a serious
> security problem.
>

As is every other mainstream application of TLS/SSL I've ever seen
coded into a mainstream application. Don't just pick on Thunderbird
for it - applications using TLS/SSL typically make MITM easy by design,
rather than difficult.

Sit you your faviorite wireless network and MITM your faviorite ssl
web sites off it. If your user population is very intelligent, maybe
only 9 out of 10 will click the "Windows is annoying me with a box and
an OK button - I will click OK to keep going" popup and ignore the
certificate mismatch utterly. Otherwise the only hard part will be
finding a user that doesn't ignore the mismatch - it's so easy to
get passwords this way it isn't even sporting. It's like whacking baby
seals with a stick.

SSL/TLS applications are just the latest most fertile ground where
software designers have put in a crutches for lazy stupid people thereby
rendering something kinda ok into something mostly useless.

-Bob
--
Bob Beck AICT
beck@bofh.ucs.ualberta.ca University of Alberta
if ((not 0 && not 1)!=(!0 && !1)){print "I want what Larry and Tom smoke!\n";}

[Jason Haar]

Bob Beck wrote:

> Sit you your faviorite wireless network and MITM your faviorite ssl
>web sites off it. If your user population is very intelligent, maybe
>only 9 out of 10 will click the "Windows is annoying me with a box and
>an OK button - I will click OK to keep going" popup and ignore the
>certificate mismatch utterly. Otherwise the only hard part will be
>finding a user that doesn't ignore the mismatch - it's so easy to
>get passwords this way it isn't even sporting. It's like whacking baby
>seals with a stick.
>
> SSL/TLS applications are just the latest most fertile ground where
>software designers have put in a crutches for lazy stupid people thereby
>rendering something kinda ok into something mostly useless.
>
>
Well said. I don't see anyone complaining that MSIE allows you to
click-through the warning that the presented cert doesn't match the
hostname and carry on and get compromised. Same with signing executables.

Users don't know what it means - and they "just want it to work!".
Frankly, there is only so much technology can do. At some stage people
have to start taking responsibility for their choices (shall we measure
the IQ of people who open GIF-file based password protected zip files
and run the contents!?!?!? Sheesh)

Actually I'm glad you can click-through and ignore cert mismatches.
Without it I couldn't read many self-signed Web sites where they use
certs just to protect their data in transit. It would smack of monopoly
practices if only Verisign-signed sites/whatever worked within browsers.

--
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1