Monthly Archives: November 2007

Leopard Clawing WoW?

Posted on by
Reply

MacOS X Leopard has issues with the firewall. For starters, the firewall is deactivated upon installation. Next, the firewall has changed so that it now operates that the application level and performs signature checks. If Apple does not have a digital signature for an application, it will sign the application itself. If at any time, the binary changes, it will be denied internet access. This is causing problems with applications that change their binaries, such as Skype and World of Warcraft. Users having issues with these applications have reported a reinstall fixing the issue. There’s much discussion about this on the WoW forums.

In other news, a new blind SQL injection tool has been released, http://sqlmap.sourceforge.net/. I haven’t personally used this tool but it looks promising. Also, the “cyber jihad” rumored to start on 11/11 is nothing more than a rumor. I remember the last time they tried this and it fizzled out to nothing, just like it likely will this time. At best they may be able to pull off some DoS attacks, but no extra precautions are required if you are regularly vigilant.

OpenBSD Ouchie, Apple QuickTime and Solaris 10 Vulns

Posted on by
Reply

In a pretty rare occurrence, a remote buffer overflow in OpenBSD has been identified. The vulnerability exists in “dhcpd”, the DHCP daemon, and allows denial of service and arbitrary code execution on 4.0 – 4.2. This issue was originally published in May, but new developments have been made in refining the exploits and in details about the issue. Patches are available, and should be installed as soon as possible.

Apple updated QuickTime to fix several identified issues, including some security problems. The updates are now available, and if you use the Apple update service, you should get them applied automatically. The big problem repaired in this release is a heap overflow that can be used to seize control of machines. We mention this update because QuickTime is one of those pesky applications that seem to turn up everywhere, in many organizations. It would likely be wise to check not only workstations, but also any servers that are used in training, multi-media or presentations. QuickTime seems to be a common tool for these mechanisms.

Lastly, Solaris 10 systems have proven to be vulnerable to a new buffer overflow in the monitoring package “srsexec”. This is installed in many Solaris systems, especially those leveraging the centralized console management and administrative console applications. Attackers with local access to the Solaris system can exploit this issue to execute arbitrary code as “root”, since the binary is suid by default. Patches are already available and should be applied as soon as practical.

Book Review: Security Power Tools

Posted on by
Reply

Authors: Burns, Granick, Manzuik, Guersch, Killion, Beauchesne, Moret, Sobrier, Lynn, Markham, Iezzoni, Biondi

Publisher: O’Reilly

$59.99

Rating: 4 out of 5 stars (****)

If you are tired of reading some Harry Potter or some such thing, and decide to devour 780+ pages of information security how-to, this is a pretty good candidate.

The book covers everything from legal and ethical issues to pretty deep knowledge of the tools and techniques used to do infosec work. It won’t make you an expert, but it is a much friendlier manual than the included docs for a whole lot of tools.

My favorite section is chapter 10, which covers the art and science of shell code, custom exploits and some great tools for making this often tough job a whole lot easier. The diagrams and code examples in this chapter alone make the book worth the money for the reference shelf, and you would get all of the rest too!

All in all, the book is easy to read, the examples are clear and easily understood. The graphics are clean and crisp, which makes it much simpler to follow along on your own systems. Basically, as with most O’Reilly books, the layout and design is excellent.

Check it out if you are getting tired of wizards and such. The ROI is likely higher and you might even learn a new skill or two to help you in the day. In the end, that should be the measure of a good security book – right?

Daylight Savings Time & Sonicwall VPN Problems

Posted on by
Reply

Day light savings time caused us to fall back an hour this weekend. Unfortunately it looks like some gadgets and systems missed the memo. Be sure to check all of your systems, routers, firewalls, and other devices to make sure they’re all in sync.

Also, Sonicwall VPN has been found vulnerable to a few issues. The issues could allow an attacker to delete arbitrary files on a host computer, or possibly even compromise the system. Sonicwall has already released an update, so get the newest firmware to mitigate these problems.

A Couple of Interesting Developments

Posted on by
Reply

First, a couple of new tools are available specifically geared at cracking Oracle 11g password hashes. These are specifically aimed at attacking the newest features that 11g introduces to better protect the passwords. They also have some short cuts for those folks still making the old style DES passwords available (likely for backwards compatibility with older apps or uses). Essentially, these new mechanisms are slower than old hash attacks, but are still effective. In today’s world of computational power and bot-net distributed password cracking capability, it is pretty darn safe to assume that if the attacker can get the hash – they can get the password.

Another issue that is likely to be an annoyance for some folks is that a new remote Denial of Service attack has been identified in Ubuntu 6.06 DHCP server. While the attacker can’t really gain access to the system using it, they can replace the dead DHCP server with their own, which could include malicious entries and other annoyances. This DHCP server is popular in many cyber cafes I have visited – particularly outside of the US. Just another reminder that you have to pay attention to network connectivity. It might seem like ubiquitous wireless access is a boon, but without the capability to trust the network you use, you have little reason to trust the content you receive!  — Just a reminder!

Noel Brings Reminder to Review DR/BC Plans

Posted on by
Reply

For those folks on the east coast, Hurricane Noel should probably figure into your weekend plans. The storm is looking like a near miss for much of the eastern seaboard, but should be a strong reminder for folks to review their Disaster Recovery and Business Continuity plans for currency.

If you look in your policies folders and don’t see a DR/BC plan, now might be a good time to form a task group for making them. Given the wacky weather patterns lately, they might prove to be handy in the future. At the very least, you can rest a little easier just knowing they are there.

For those folks wondering what I am talking about, click here for more info on the storm.

If you want to do more reading on DR/BC policies, check out this wikipedia article.

Vulnerability Updates, Firefox 2.0.0.9, and a Mac Trojan

Posted on by
Reply

Similar to previously reported vulnerabilities, Symantec’s Mail Security Appliance is vulnerable to denial of service and a buffer overflow. This is due to insecurity in a third party tool. The exploit can be triggered when the appliance checks a specially crafted file. Administrators are recommended to update to version 5.0.0-36 or later.

Two ActiveX controls installed on client systems using SonicWALL SSL VPN contain vulnerabilities. The first, NeLaunchCtrl, contains boundary errors in a number of functions that could result in a buffer overflow by visiting a malicious site. The WebCacheCleaner control contains an insecure “FileDelete()” method that can be exploited to delete arbitrary files on a system. Firewall admins should update to firmware version 2.5 for SonicWALL SSL VPN 2000/4000, and version 2.1 for SonicWALL SSL-VPN 200.

Hewlett-Packard OpenView Radia Integration Server contains a vulnerability that could allow remote attackers to access arbitrary files on the system. The issues is within the HTTP server running on TCP port 3456 and can be exploited without authentication. Attackers could use this to access configuration or log files which could aid in furthering an attack.

In other news, Firefox update 2.0.0.9 has been released. This is not a security fix, but a stability release. Users should be running at least version 2.0.0.8.

A mac based Trojan, a malicious video codec, is in the wild. Spam emails directing people to pornographic websites are hoping to lure users in to downloading a required codec to watch videos. Once downloaded, no codec is actually installed but a Trojan virus instead.

Slight Increases in SSH Probes

Posted on by
Reply

Our HoneyPoints have been picking up slight increases in the probes and brute force attacks against port 22 – SSH. We are seeing increases in wide scale SSH scans and attacks against common login/password combinations.

Now might be a good time for folks to take a look at their perimeter and make sure no one has poked an SSH exposure through. If you have some, they should be immediatly audited for common account use. Treat any system with these issues as likely compromised and initiate an investigation.

Most of these compromised systems are used for further scanning and many have bot-net clients installed. Keep an extra eye on your logs for obvious forms of bot-net traffic, such as IRC connections, odd ports and outbound half-open TCP connections.

InstallShield Issues and BorderManager Vulns

Posted on by
Reply

Macrovision InstallShield Update Service contains an insecure method vulnerability. InstallShield contains an ActiveX control that is marked safe for scripting. An attacker could leverage the update service to download and install malicious software. Due to the fact that it is marked safe for scripting, this could be exploited by a malicious web site or a downloaded application. The following ActiveX control should be disabled so that Internet Explorer will not load the control.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E9880553-B8A7-4960-A668-95C68BED571E}]

“Compatibility Flags”=dword:00000400

The updated versions of FlexNet and InstallShield products will not be marked safe for scripting.

Additionally, Novell Border Manager Client is vulnerable to a remote heap-based buffer overflow. The vulnerability exists within the Client Trust Application and can be exploited by sending a specially crafted packet to the application. Successful exploitation could result in the exploitation of arbitrary code. The vulnerability is reported in Novell BorderManager 3.8.