Network Appliance iSCSI Authentication Bypass

[advisories@matasano.com]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

# Security Advisory: Network Appliance iSCSI Authentication Bypass

## Origin Date: Wed Aug 3 2005

## Publication Date: Mon Oct 24 2005

## Synopsis

Unauthenticated iSCSI Initiators can bypass iSCSI authentication on
NetApp Filers by manipulating the iSCSI Login Negotiation
protocol. The impact of this vulnerability is the negation of iSCSI
security on affected NetApp filers.

## Details

### Background

iSCSI is a TCP protocol running over a well-known port, over which
iSCSI records are exchanged. Full-featured iSCSI sessions provide
access to raw disk blocks conveyed as SCSI messages inside iSCSI
records. Security in an iSCSI deployment is typically based on strong
authentication, which proves that an iSCSI client ("initiator") is
allowed access to disk blocks on an iSCSI server and target LUNs
("target" and "LUN").

### Vulnerability

iSCSI authentication occurs via LOGINREQUEST and LOGINRESPONSE iSCSI
records, which are used to negotiate authentication parameters,
including the initiator, target, and mode of authentication. iSCSI
"Login Negotiation" occurs in 3 phases:

1. Security ("Start") mode, where the client and server verify their
identity.

2. Operational mode, where the client and server negotiate
non-security-related session parameters.

3. FullFeature mode, where the client and server exchange SCSI
commands.

The problem we have observed is that an iSCSI clients can launch
negotiation attacks in which clients force servers to transition from
Security phase to Operational phase **without proving identity**.

To exploit this problem, we wrote a custom iSCSI client that short
circuits login negotiation, asserting an unchecked transition to
Operational mode. Affected Filers honor the client assertion, bypassing
authentication.

There is no known exploit code circulating for this vulnerability.

### Impact

Data stored in iSCSI-mapped LUNs on affected Network Appliance Filers
can be read and altered by an attacker. Unmapped LUNS and LUNs mapped
only to Fibre Channel initiators are not vulnerability to this attack.

### Target

Network Appliance Data ONTAP Operating System, Releases 6.4, 6.5, and
7.0.

### Vendor Response

Network Appliance Data ONTAP 7.0.2 is a General Availability release:
http://now.netapp.com/NOW/cgi-bin/software


Release of this advisory was coordinated with Network
Appliance. Network Appliance has confirmed this vulnerability. For
further information about the vulnerability disclosed in this
advisory, see
[NOW.NETAPP.COM BugsOnline](http://now.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=169359).

## Origin

Thomas H. Ptacek, Matasano Security

tqbf _at_ matasano.com

For more information on this advisory, please contact

advisories _at_ matasano.com

http://www.matasano.com/advisories/netapp-iSCSI.txt

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iD8DBQFDXVXc9HF8IN5vKKkRAjhSAKCwFOc+hfquaCzAt4Tta8 COy0cb3gCePw7s
/xsX/6qNLZpOAT2ySApgtNE=
=kdhZ
-----END PGP SIGNATURE-----

[Steve Shockley]

advisories@matasano.com wrote:
> ### Vendor Response
>
> Network Appliance Data ONTAP 7.0.2 is a General Availability release:
> http://now.netapp.com/NOW/cgi-bin/software
>
>
> Release of this advisory was coordinated with Network
> Appliance. Network Appliance has confirmed this vulnerability. For
> further information about the vulnerability disclosed in this
> advisory, see
> [NOW.NETAPP.COM BugsOnline](http://now.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=169359).

Network Appliance sent out Field Alert Notice #260 to customers today
about this upgrade. From their email:

Important Fixes
---------------
175888 - Filer stops serving NFS after a bad thread synchronization
event

176788 - FAS3020/FAS3050 may respond slowly to requests, exhibit poor
performance

That's it. NOT ONE WORD ABOUT A VULNERABILITY OR A FIX. From reading
that synopsis, if I weren't using NFS or a FAS3020/FAS3050, I probably
wouldn't be very interested in applying the update, and my systems would
remain vulnerable.

You're releasing security fixes for an infrastructure product without
telling your customers! Who do you think you are, Cisco?

Almost as annoying: I went to view the NetApp pages linked above, and
the site made me register. After registration, I'm told I'm not
authorized to view the pages. (So why'd you want me to register?)

[steve.shockley@shockley.net]

Quoting Steve Shockley <steve.shockley@shockley.net>:

> That's it. NOT ONE WORD ABOUT A VULNERABILITY OR A FIX.

In NetApp's defense, they did send out an advisory to customers five
hours after
the initial notice of the availability of the fix. I understand only
customers
who have licensed the iSCSI component get a notification.