Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
8
Advantages: Improved security “stance” still fairly easy to setup and 
administrate.
Disadvantages: Not quite as simple to setup as first two options, still not 
as many layers for a “security in depth” approach as there could be.
Topology 4
VPN server in a DMZ with the connected VPN user then allowed inside 
LAN through LAN firewall.
This is a much more ideal configuration. Multiple layers of checking and 
protection. Unfortunately either budget, time, resources, or administrator skill 
level tend to not be available for such an ideal setup. This can be improved upon 
even more with additional layers of firewalls and other “tricks of the trade”. 
Advantages: Much more secure stance, security in layers.
Disadvantages: High complexity to setup and administrate, added cost, 
more advanced skill sets required.
Topology 5
VPN server in a DMZ  but as another gateway (aka hole) into LAN, 
usually the VPN server acts as yet another firewall as well (unfortunately not 
always though), and doesn’t allow any traffic in except those actually connected 
to it via the VPN.
This is not as ideal a setup as Topology 4, but one that is not uncommon. 
It is a mix between option 3 and option 4, but NOT as secure as option 4 since 
there isn’t a second firewall performing additional checking before allowing 
access to the LAN.
Advantages: Slightly easier setup and administration than option 4.
Disadvantages: Security level is only about equivalent to option 3.
0

---