CVE-2017-17023

The Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e.com). The affected client software, "Sophos IPSec Client" 11.04 is a rebranded version of NCP "Secure Entry Client" 10.11 r32792. A vulnerability in the software update feature of the VPN client allows a man-in-the-middle (MITM) or man-on-the-side (MOTS) attacker to execute arbitrary, malicious software on a target user's computer. This is related to SIC_V11.04-64.exe (Sophos), NCP_EntryCl_Windows_x86_1004_31799.exe (NCP), and ncpmon.exe (both Sophos and NCP). The vulnerability exists because: (1) the VPN client requests update metadata over an insecure HTTP connection; and (2) the client software does not check if the software update is signed before running it.

CVSS v3 8.1 HIGH
CVSS v2.0 9.3 HIGH

8.1^/10

CVSS v3 : HIGH

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://www.ncp-e.com/en/resources/download-vpn-client/#c8680	Vendor Advisory
https://www.ncp-e.com/fileadmin/pdf/service_support/release_notes/NCP_Secure_Clients/NCP_Secure_Entry_Client/NCP_RN_Win_Secure_Entry_Client_11_14_r42039_en.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ncp-e:ncp_secure_entry_client:10.11:32792::::windows::*
	cpe:2.3:a:sophos:ipsec_client:11.04:::::::*

History

No history.

Information

Published : 2019-04-09 18:29

Updated : 2023-12-10 12:59

NVD link : CVE-2017-17023

Mitre link : CVE-2017-17023

CVE.ORG link : CVE-2017-17023

JSON object : View

Products Affected

ncp-e

ncp_secure_entry_client

sophos

ipsec_client

CWE

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2017-17023", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2019-04-09T18:29:00.280", "references": [{"url": "https://www.ncp-e.com/en/resources/download-vpn-client/#c8680", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.ncp-e.com/fileadmin/pdf/service_support/release_notes/NCP_Secure_Clients/NCP_Secure_Entry_Client/NCP_RN_Win_Secure_Entry_Client_11_14_r42039_en.pdf", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "The Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e.com). The affected client software, \"Sophos IPSec Client\" 11.04 is a rebranded version of NCP \"Secure Entry Client\" 10.11 r32792. A vulnerability in the software update feature of the VPN client allows a man-in-the-middle (MITM) or man-on-the-side (MOTS) attacker to execute arbitrary, malicious software on a target user's computer. This is related to SIC_V11.04-64.exe (Sophos), NCP_EntryCl_Windows_x86_1004_31799.exe (NCP), and ncpmon.exe (both Sophos and NCP). The vulnerability exists because: (1) the VPN client requests update metadata over an insecure HTTP connection; and (2) the client software does not check if the software update is signed before running it."}, {"lang": "es", "value": "El Endpoint UTM VPN de Sophos interact\u00faa con el software de cliente proporcionado por NPC Engineering (www.ncp-e.com). El software cliente afectado, \"Sophos IPSec Client\" versi\u00f3n 11.04 es una versi\u00f3n rebautizada de NCP \"Secure Entry Client\" versi\u00f3n 10.11 r32792. Una vulnerabilidad en la funci\u00f3n software update del cliente VPN permite que un atacante man-in-the-middle (MITM) o man-on-the-side (MOTS) ejecute software malicioso y arbitrario en el equipo de un usuario de destino. Esto est\u00e1 relacionado con SIC_V versi\u00f3n 11.04-64.exe (Sophos), NCP_EntryCl_Windows_x86_1004_31799.exe (NCP) y ncpmon.exe (tanto Sophos como NCP). La vulnerabilidad existe porque: (1) el cliente VPN solicita metadatos de actualizaci\u00f3n por medio de una conexi\u00f3n HTTP no segura; y (2) el software cliente no comprueba si la actualizaci\u00f3n de software est\u00e1 firmada previo a ejecutarla."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ncp-e:ncp_secure_entry_client:10.11:32792:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "C3154F49-4D0F-46DF-B81F-59F4A24A8790"}, {"criteria": "cpe:2.3:a:sophos:ipsec_client:11.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A81C85C-AD5F-4A7E-8E12-2B396AFCDEC8"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}