CVE-2020-3483 : Security Advisory and Response

Duo Network Gateway (DNG) Information Disclosure Vulnerability

Understanding CVE-2020-3483

Duo Network Gateway (DNG) has a vulnerability that allows private key information to be logged in plain text, potentially compromising SSL/TLS connections.

What is CVE-2020-3483?

The vulnerability in Duo Network Gateway (DNG) allows for the logging of customer-provided SSL certificates and private keys in plain text, exposing sensitive information.

The Impact of CVE-2020-3483

The vulnerability could lead to unauthorized access to private key information, enabling attackers to decrypt and manipulate SSL/TLS connections to the DNG and protected applications.

Technical Details of CVE-2020-3483

Duo Network Gateway (DNG) Vulnerability

Vulnerability Description

SSL certificates and private keys were not excluded from logging, leading to plain-text storage on the DNG host.
Attackers with access to DNG logs could decrypt SSL/TLS connections.

Affected Systems and Versions

Affected versions: 1.3.3 through 1.5.7 of Duo Network Gateway (DNG).

Exploitation Mechanism

Attackers gaining access to DNG logs could intercept and manipulate network traffic, compromising SSL/TLS connections.

Mitigation and Prevention

Steps to Address CVE-2020-3483

Immediate Steps to Take

Upgrade to version 1.5.8 of Duo Network Gateway (DNG) to mitigate the vulnerability.
Search for stored certificate and key information in logs.

Long-Term Security Practices

Regularly monitor and audit log files for sensitive information.
Implement encryption mechanisms for stored credentials.

Patching and Updates

Follow upgrade instructions on the DNG page to ensure the latest version is installed.