Mozilla Thunderbird SMTP down-negotiation weakness
Thomas Henlich <thomas@henlich.de>
Summary
Mozilla Thunderbird SMTP down-negotiation behaviour allows a man-in-the-middle (MITM) attack to bypass TLS initialization and/or downgrade CRAM-MD5 to PLAIN authentication, leading to exposure of authentication information. Failure in CRAM-MD5 authentication also leads to exposure of authentication information to a passive eavesdropper.
Background
Mozilla Thunderbird is a mail user agent with support for SMTP PLAIN and CRAM-MD5 authentication and for secure SMTP over TLS.
CRAM-MD5 is a method for secure user authentication which avoids plaintext transmission of sensitive information (account/password). TLS is a security protocol to protect transmitted data against eavesdropping.
Affected versions
- Mozilla Thunderbird 1.0.7 (20050923)
- Mozilla Thunderbird 1.5 Beta 2 (20051006)
- possibly other programs using the Mozilla mail component
Description
The SMTP negotiation in Mozilla Thunderbird is implemented in a way that if a secure data exchange (CRAM-MD5 or STARTTLS) between client and server can not be established, an insecure method is used instead. The user is not notified of this and can not cancel this insecure data exchange. An intermediate attacker can utilize this behaviour to gain sensitive account/password information. As CRAM-MD5 and TLS were designed to avoid eavesdropping attacks, currently the implementation of Mozilla's SMTP client fails to meet these design goals. Several methods of attack are possible:
A1. Passive eavesdropping attack on CRAM-MD5 authentication failure
Scenario
- Client (C) Mozilla Thunderbird
- SMTP server (S) which supports and advertises PLAIN and CRAM-MD5 authentication
- Attacker A1 who can read network traffic from C to S
Sequence of attack
- User accidentally mistypes password (e.g. "secrez" instead "secret").
- C tries CRAM-MD5 authentication which fails.
- C retries with PLAIN authentication.
- A1 can guess the correct password from sniffed connection.
A2. One-way active MITM attack on CRAM-MD5 capability advertisement
Scenario
- Client (C) Mozilla Thunderbird
- SMTP server (S) which supports and advertises PLAIN and CRAM-MD5 authentication.
- Attacker A2 who can read network traffic from C to S and modify network traffic from S to C
Sequence of attack
- S sends EHLO response.
- A2 discards S's SMTP authentication advertisement and sends "AUTH PLAIN" advertisement to C.
- C connects with PLAIN authentication.
- A2 can read cleartext password.
A3. One-way active MITM attack on CRAM-MD5 authentication attempt
Scenario
- Client (C) Mozilla Thunderbird
- SMTP server (S) which supports and advertises PLAIN and CRAM-MD5 authentication.
- Attacker A3 who can read and modify network traffic from C to S
Sequence of attack
- S sends CRAM-MD5 challenge to C.
- C sends authentication, but A3 transmits a different (random) response causing authentication to fail.
- C reauthenticates with PLAIN authentication.
- A3 can read cleartext password.
A4. One-way active MITM attack on STARTTLS capability advertisement
Scenario
- Client (C) Mozilla Thunderbird
- SMTP server which supports and advertises STARTTLS
- Attacker A4 who can read network traffic from C to S and modify network traffic from S to C
Sequence of attack
- S sends EHLO response with STARTTLS advertisement.
- A4 discards S's STARTTLS advertisement.
- PLAIN authentication takes place.
- A4 can read cleartext password.
Resolution
For A1-A3 no resolution is known. For A4, set user preference to enforce TLS.
Proof of concept
A TCP proxy application demonstrating these weaknesses is available from http://www.henlich.de/moz-smtp/stcppipe-x.zip
Timeline
- 2005-10-08: Opened Bugzilla Bug 311657
- 2005-10-11: Reported to security@mozilla.org
Impressum & Datenschutz