SECURITY SOFTWARE & -TOOLS — THE HEADLINES

 2001/12/05 

Security vulnerability in Cisco's IOS firewall feature set

 2001/11/20 

Blocking Checkpoint management functions

 2001/11/16 

Raptor Firewall zero length UDP packet resource consumption

 2001/11/12 

Personal firewalls spring security leaks

 2001/10/25 

Cisco PIX Firewall Manager password disclosure

SECURITY SOFTWARE & -TOOLS — THE LINKS

• "Why Firewalls?" by Kurt Seifried for SecurityPortal
• SNORT — small, network-based Intrusion Detection System for Unix/Linux based systems

  Disclaimer: These hyper-links to external content may be submitted by visitors of this site. Their contents do not represent the opinion of this publication. The links will be reviewed by an editor and may be modified, rejected or deleted at any time.

SECURITY SOFTWARE & -TOOLS — THE NEWS

2001/12/05

23:25 +0100

Security vulnerability in Cisco's IOS firewall feature set

[Security Software & -Tools] The IOS Firewall Feature set, also known as Cisco Secure Integrated Software, or Context Based Access Control, was introduced in IOS version 11.2P. A vulnerability in the IOS Firewall Feature set permits traffic that should be denied by the dynamic access control lists, the Cisco Systems Product Security Incident Response Team admits.

This vulnerability is documented as Cisco Bug ID CSCdv48261. No other Cisco product is said to be vulnerable. There is no workaround.

Only configurations implementing CBAC are affected. An affected configuration includes the lines "ip inspect" in your router's configuration. For additional information regarding Cisco IOS image identifiers consult the document at cisco.com/warp. The major affected Cisco IOS trains are: 11.2P, 11.3T, 12.0, 12.0T, 12.1, 12.1T, 12.1E, 12.2, 12.2T.

In addition to these, several Early Deployment (also known as X releases) are affected. The complete list is given in the Software Versions and Fixes section of this advisory. Affected hardware models are: Cisco routers in the series 800, 820, 950, 1400, 1600, 1700, 2500, 2600, 3600, 4000 Gateway, 4224, 7100, 7200, 7400, 7500, SOHO 70, ubr900, ICS7750. As well as the Catalyst 5000 and 6000 if they are running Cisco IOS software. No other Cisco products are affected.

Please use the provided table to verify whether your product is vulnerable, and a fix is available for it: cisco.com/warp. Cisco is offering free software upgrades to eliminate this vulnerability for all affected customers. // c.f. SecuriTeam :: [dre].

Comments (0)

2001/11/20

10:07 +0100

Blocking Checkpoint management functions

[Security Software & -Tools] QinetiQ SHC Research reported a condition with the RDP Protocol in Check Point's VPN-1/ FireWall-1 4.1 and Next Generation (NG) that may affect system stability. If the error occurs on a 4.1 module, certain management functions, such as logging and administrator communications, will halt.

On NG modules, encryption key processing may be briefly interrupted. At no point is security compromised, and the firewall continues to enforce the security policy and allows appropriate traffic. No unauthorized access, information leakage or breach of security occurs.

Check Point knows of no organizations that have had systems affected by this issue. However, Check Point recommends the hot fix below be immediately installed.

A fix for VPN-1/ FireWall-1 4.1 and Next Generation (NG) on all platforms is available for immediate download at checkpoint.com/techsupport. // c.f. RUS-CERT :: [dre].

Comments (0)

2001/11/16

09:30 +0100

Raptor Firewall zero length UDP packet resource consumption

[Security Software & -Tools] Raptor Firewall is a commercially available firewall implementation distributed by Symantec. A problem with the handling of UDP packets by the firewall has been discovered by Max Moser of remote-exploit.org: When the firewall receives zero length UDP packets, the machine hosting the firewall becomes processor bound, with the firewall taking 100% of the CPU.

This makes it possible for a remote user to crash the firewall, denying service to legitimate users of network resources. A reboot is required for the system to resume normal operation.

Affected are Symantec Raptor Firewall 4.0.0 HP-UX, 5.0.3 Windows NT, 6.0.2 Windows NT, 6.0.2 Solaris, 6.0.3 HP-UX, 6.5 Windows NT, Symantec VelociRaptor 1.0 & 1.1.

There are no known vendor patches available, but the problem has reportedly been fixed in version more recent than 6.5. // c.f. RUS-CERT, SecurityFocus :: [dre].

Comments (0)

2001/11/12

10:08 +0100

Personal firewalls spring security leaks

[Security Software & -Tools] Software firewalls deployed by millions of PC users offer only "illusory" protection against Trojan horses and other malicious programs, security experts are cited by NewsBytes. Techniques for defeating the outbound data filters in popular personal firewalls such as Zone Alarm and Norton Personal Firewall have been independently posted on the Web by several researchers. Using the methods described, a rogue program could upload private user data without being detected by the firewall, the experts claim.

To evade a firewall's guards against unauthorized data leaks, the new techniques include commandeering a legitimate program such as Microsoft's Internet Explorer and forcing it to send out data on behalf of the attacker. "If a firewall is going to allow some program to transmit and receive data over the Internet, and that program allows other programs to control its actions, then there's no point in blocking anything at all," wrote Bob Sundling in text accompanying the source code of TooLeaky, a firewall test program he developed to demonstrate the problems.

FireHole, a similar testing tool, also has been made available on the Web by its author, Robin Keir, lead network security programmer with Foundstone, a computer security consulting firm. Both TooLeaky and FireHole sneak past personal firewalls and upload harmless test data to an external site. According to Gregor Freund, chief operating officer for Zone Labs, FireHole exploits a known security flaw in Windows referred to as SetWindowHookEx, which allows an application to insert code into another program.

Freund said that Zone Labs will release an update to Zone Alarm next week that will provide limited protection against the bug on Windows NT, 2000, and XP systems. A more complete fix will be incorporated in the next full release of Zone Alarm, version 3.0, which is due in January. Freund said users can easily defeat the technique used by TooLeaky by configuring Zone Alarm to require Internet Explorer to ask permission every time it accesses the Internet.

Keir told Newsbytes that other techniques are likely to be discovered for defeating outbound filtering, and that the development suggests that blocking leaks is "a race the firewall makers will never win." Nonetheless, Keir said he still believes personal firewalls are valuable for their ability to block incoming attacks.

A third firewall test utility, YALTA, creates a virtual device driver that sends data to any Internet address without being detected by firewalls, according to a description of the program, which stands for Yet Another Leak Test Application. The new firewall testing utilities represent a second generation of such programs, building upon a tool developed by Gibson Research Corp. After GRC president Steve Gibson released LeakTest a year ago to highlight what he called "internal extrusion" flaws in personal firewalls, many vendors made changes to improve the outbound filtering techniques used in their firewall products.

Product manager Tom Powledge told Newsbytes that Symantec was studying the new firewall bypass techniques and would likely revise Norton Personal Firewall to defend against them. But Powledge noted that computer users require anti-virus software and safe computing practices to prevent rogue programs from establishing a beachhead. "Once a hacker has code running on your computer, they have a tremendous amount of power. We've always said that effective Internet security is a combination of tactics," said Powledge.

All three of the ICSA certified products, Zone Alarm, Norton Personal Firewall, and Tiny Software's Tiny Personal Firewall, can be defeated by the new outbound attacks in some circumstances, according to the authors of TooLeaky and FireHole. An ICSA representative said the firm was still testing the new tools and had no immediate comment. // c.f. CyberCrime-Alerts :: [dre].

Comments (0)

2001/10/25

09:43 +0100

Cisco PIX Firewall Manager password disclosure

[Security Software & -Tools] Novacoast has discovered a vulnerability in the Cisco PIX Firewall Manager software that exposes and records the enable password of the managed PIX device in plaintext. Attackers may use this vulnerability to obtain full access to the PIX firewall. The tested version is PFM 4.3(2)g. Although the vulnerability is not dependent on the version of the PIX Firewall, this exploit was found with a PIX 5.2(1).

The PIX Firewall Manager (PFM) is a software product that allows the configuration of Cisco PIX Firewall devices via a web-based GUI. PFM is installed and run on a standard Windows NT workstation or server that serves as the management station. There is a flaw in PFM that upon successful connection to a PIX device, the enable password is saved in plaintext on the management station. The password is recorded in an unencrypted log file stored in a directory created by the install, which by default has no access restrictions. If the management station is compromised, the attacker can retrieve the enable password. This, of course, can be then be used to grant full access to the PIX Firewall.

Cisco has stated that PFM should be replaced by the PIX Device Manager product, and thus a fix for this exploit will not be made available. Further product information is located here: cisco.com/warp. Cisco recommends the following: Upgrade the software on the PIX device to the version 6.0 or higher. Uninstall PIX Firewall Manager from the NT workstation. Begin using PIX Device Manager for GUI management of the PIX device. // c.f. SecuriTeam :: [dre].

Comments (0)