Security Auditor's Research Assistant (SARA) ReportWriter

SARA Scan Results 10 May 2002
place document number here

SARA Scan Results of sara-data

INTRODUCTION

Advanced Research Corporation ® was tasked to perform a Security Auditor's Research Assistant (SARA) security scan on hosts on the sara-data sub-nets. The SARA scan was performed to identify potential security vulnerabilities in the sara-data sub-domain. The SARA scan was completed on 2002/05/10 and its scan mode was set to extreme. The version of SARA was Version 3.5.6b .

DISCUSSION

SARA is a third generation security analysis tool that analyzes network-based services on the target computers. SARA classifies a detected service in one of five categories:

Green: Services found that were not exploitable
Grey: No services or vulnerabilities
Red: Services with potentially severe exploits (account compromise)
Yellow: Services with potentially serious exploits found (data compromise)
Brown: Possible security problems.

A total of 3 devices were detected of which 2 are possibly vulnerable. Figure 1 summarizes this scan by color where the Green bar indicates hosts with no detected vulnerabilities. Grey indicates hosts with no services. The Red bar indicates hosts that have one or more red vulnerabilities. The Yellow bar indicates hosts that have one or more yellow vulnerabilities (but no red). And the Brown bar indicates hosts that have one or more brown problems (but no red or yellow)

Green

Grey

Red

Yellow

Brown

Figure 1 Host Summary by Color

The SARA scan results are distributed as three appendices to this paper:

Appendix A: Previous scan results
Appendix B: Sub-net tables depicting hosts, host-types, and vulnerability counts.
Appendix C: Details on the hosts reported
Appendix D: Vulnerabilities sorted by severity
Appendix E: Description of the vulnerabilities

Appendices are hyper-linked to assist the reader in navigating through this report. The report includes information on all non-Windows hosts that have one or more vulnerabilities. In addition, Windows hosts that have Red and/or Yellow vulnerabilities are also included.

RECOMMENDATION

The identified hosts should be analyzed immediately.

END OF SECTION

Appendix A

END OF SECTION

Appendix B

SARA Scan Summary

Host Name	IP Address	Host Type	Green	Red	Yellow	Brown	FP
fujitsu	127.0.0.1	unknown type	1	2	3	1	0

Table 1 Hosts on Sub-net 127.0.0

Host Name	IP Address	Host Type	Green	Red	Yellow	Brown	FP
192.168.1.1	192.168.1.1	Windows	5	1	1	1	0

Table 1 Hosts on Sub-net 192.168.1

END OF SECTION

Appendix C

Scan Details

Host: fujitsu

General host information:

Host type: unknown type

Subnet 127.0.0

X Windows server (GREEN)

Vulnerability information:

Apache (less than 1.3.21) is vulnerable to multiple exploits (http)(RED)

OpenSSH may be vulnerable to version 1 fallback(RED)

Probable smtp relay (spam)(YELLOW)

Apache (less than 1.3.21) is vulnerable to multiple exploits (http)(YELLOW)

sgi fam version may be vulnerable to buffer overflow(YELLOW)

rpc.statd is enabled and may be vulnerable(BROWN)

Host: 192.168.1.1

General host information:

Host type: Windows

Subnet 192.168.1

LDAP over SSL server (GREEN)

SMB server (GREEN)

WWW (1029:TCP) server (GREEN)

WWW (Secure) server (GREEN)

WWW (http-rpc-epmap) server (GREEN)

Vulnerability information:

Multiple IIS vulnerabilities (HTR ASP)(RED)

Multiple IIS vulnerabilities (HTR ASP)(YELLOW)

Possible smtp relay; MS may give a false positive(BROWN)

END OF SECTION

Appendix D

Vulnerability List by Severity

192.168.1.1:(Multiple IIS vulnerabilities (HTR ASP))

END OF SECTION

Appendix E

Vulnerability Tutorials

Tutorial: Potentially_Vulnerable_Web_Server.html

Tutorial - Vulnerable Web Server

Vulnerable Web Server

Impact

IIS:

Microsoft placed a password backdoor in their IIS 4 and IIS 5 products. Knowledge of the password can provide the user to certain Web administrater operations.

Netscape:

Most versions of Netscape Enterprise Server Netscape prior to version 4.1 may be vulnerable to a buffer overflow attack. This includes both Netscape and iPlanet servers.

WebSite Pro:

Many versions of O'Reilly's WebSitePro Server (httpd_32.exe) may be vulnerable to a buffer overflow attack. Version 2.4.x have been confirmed to be vulnerable. Prior versions may also be vulnerable.

BEA Weblogic:

Several buffer overflows in plugins provided by several BEA Weblogic servers allow a remote attacker to execute arbitrary code on the system running the proxying web server

Apache:

A condition exists in many apache servers up to and including version 1.3.13 that may enable the malicious user to read arbitrary files.

Background

IIS:

Microsoft installed a password backdoor in IIS 4.0 and IIS 5.0 servers where they could access and control Web servers.

Netscape:

ISS XForce has reported potential vulnerabilities in all Netscape servers prior to migrating to the iPlanet configuration. In addition, vulnerabilities in iPlanet 4.0 have been identified.

BEA Weblogic:

These web servers can be configured to redirect requests for servlets and JSP files to a Weblogic server running on the same or on a different host. The net result of this is remote execution of arbitrary code as the user running the proxying server (generally root on UNIX systems, SYSTEM on MS NT).

Apache:

If a RewriteRule directive is expressed whose result maps to a filename containing regular expression references, the result may provide an attacker with the ability to view arbitrary files on the host.

Resolution

IIS:

Microsoft has released a patch which rectifies the issue on the ISS 5.0 buffer overflow at

ReleaseId 29321

On 10 April 2002, Microsoft released 10 advisories on various vulnerabilities with IIS 4.0, 5.0, and 5.1. Refer to Microsoft Technet Bulletin MS02-018.

Reference: www.securityfocus.com/bid/2674

As of 15 May 2001, Microsoft has not issued an advisory on the password backdoor. However, various CERTs have stated that Microsoft recommends deleting the dvwssr.dll file in any of the FrontPage directories.

Netscape:

Reference: X-Force advisory 39

WebSite Pro:

http://website.oreilly.com/support/software/wsp2x_updates.cfm

Reference: CIS advisores

BEA Weblogic:

download

Reference: www.securityfocus.com/bid/1570

Apache:

www.apache.org

Reference: www.securityfocus.com/bid/1728

CVE References(s):

CVE-2000-0913 CVE-2000-0883 CVE-2000-0869 CVE-2000-0868 CVE-2000-0505 CVE-1999-0853 CVE-1999-0752 CVE-1999-0751 CVE-1999-0744 CVE-1999-0685 CVE-1999-0289 CVE-1999-0071

Tutorial: rpc_statd_access.html

Tutorial - RPC.STATD access

rpc.statd access

Summary

rpc.statd: The NFS support program, rpc.statd can be exploited through a buffer overflow attack.

Impact

A remote intruder can execute commands as root if the buffer overflow attack is successful.

The problem

The rpc.statd program is a support program to NFS which supports file locking when requested. Older versions of statd are vulnerable to a buffer overflow attack where a well crafted pattern could execute arbitrary commands as the root user

Fix

Where possible (i.e., not using NFS), disable rpc.statd in either the inetd.conf or in one of the rc.d "S" files.
Otherwise, patch the system to a version that is not vulnerable to the buffer overflow attack.

Other tips

Refer to the

CIAC Bulletin

CVE References(s):

CVE-2000-0666 CVE-1999-0493 CVE-1999-0019 CVE-1999-0018

Tutorial: sgi_fam_version.html

sgi_fam_version

SGI_FAM Version

Summary

sgi_fam: A Silicon Graphics daemon that is an RPC server that tracks changes to the filesystem under the IRIX operating system.

Impact

The vulnerability can be exploited remotely by using carefully crafted RPC packets that are sent to the fam daemon. It can lead to unauthorized access to the names of files and directories on an IRIX system.

The Problem

The sgi_fam daemon on IRIX 5.x and 6.x systems can be compromised which can reveal the names of files and directories on the system. Apparently, the contents of the files can not be read or modified. SGI is currently working on a solution. IRIX 6.5.8 and above will not be effected

Fix

As a temporary measure, disable sgi_fam in the inetd.conf file.

Where appropriate, download updated software from http://oss.sgi.com/projects/fam/. This update will have to be compiled and installed.
Install the patch from SGI when it becomes available.

Reference(s):

NAI Security Bulletin 16
SGI Security Advisory.

CVE References(s):

CVE-1999-0059

Tutorial: SMTP_could_be_a_mail_relay.html

Tutorial - Mail Relay Problem

Mail Relay Problem

Impact

Many versions of the sendmail program and other mail transport agents (MTAs) do not provide sufficient safeguards against mailcious users sending spam mail through a third party computer. Further, the spam mail will often have a forged source address.

Background

Until 1999, most implementations of sendmail and its clones provided little checking of source and destination addresses. For example a user on host A could use the sendmail on Host B sending mail to a user on Host C with a source email address from Host D. In other words, A hacker on foo.bar.com would use the sendmail at host1.swipnet.se to send a message 5,000 users with the source address of [email protected].

Similar problems have been detected with Microsoft Mail and Microsoft Exchange products. However, older Microsoft products report a relay operation when none occurred (false positive).

Some MTA's may time out during SARA testing. In these cases, the MTA must be exercised manually to determine if it is a relay.

Resolution

Vendor and Web server patches and workarounds to protect against this vulnerability are available. If your vendor does not have an upgrade, current versions of sendmail from

sendmail.org

Tutorial: SMTP_may_be_a_mail_relay.html

SMTP_may_be_a_mail_relay

Mail Relay Problem

Impact

Many versions of the sendmail program and other mail transport agents (MTAs) do not provide sufficient safeguards against malicious users sending spam mail through a third party computer. Further, the spam mail will often have a forged source address.

Background

Until 1999, most implementations of sendmail and its clones provided little checking of source and destination addresses. For example a user on host A could use the sendmail on Host B sending mail to a user on Host C with a source email address from Host D. In other words, A hacker on foo.bar.com would use the sendmail at host1.swipnet.se to send a message to 5,000 users with the source address of [email protected].

Similar problems have been detected with Microsoft Mail and Microsoft Exchange products. However, older Microsoft products report a relay operation when none occurred (false positive).

Some MTA's may time out during SARA testing. In these cases, the MTA must be exercised manually to determine if it is a relay.

Resolution

Vendor and Web server patches and workarounds to protect against this vulnerability are available. If your vendor does not have an upgrade, current versions of sendmail from sendmail.org. In addition, sendmail.org has an excellent tutorial on the subject.

Tutorial: SSH_vulnerabilities.html

SSH_vulnerabilities

SSH Agent Vulnerabilities

Impact

This document will summarize vulnerabilities in the ssh cryptographic login program. These vulnerabilites enables a malicious user to access a remote host without proper authorization. Numerous flaws have been uncovered in the implementation of the SSH protocol.

The Problem

All versions of SSH and openSSH up to and including SSH-1.5-1.2.31 are vulnerable to one or more exploits that can result in remote root compromise. There are third party patches that correct most of these exploits but not supported by the ssh vendors.

In addition, many SSH version 2 implementations that are configured for verion 1 fallback are vulnerable to the CRC32 exploit.

Resolutions

Vendors recommend upgrading to SSH version 2 protocol products. Most of these exploits do not exist in the newer version 2. However, be sure that the version 2 implmentation does not support version 1 fallback or confirm that it has been patched for fallback.

References

http://www.securityfocus.com/bid/2347

http://www.securityfocus.com/bid/2344

http://www.securityfocus.com/bid/2345

Cert Advisory 98.08

CVE References(s):

CVE-2001-0816 CVE-2001-0361 CVE-1999-1010 CVE-1999-0310 CVE-1999-0248

END OF SECTION

Security Auditor's Research Assistant (SARA) ReportWriter

SARA Scan Results of sara-data

Appendix A

Appendix B

SARA Scan Summary

Appendix C

Scan Details

Host: fujitsu

General host information:

Vulnerability information:

Host: 192.168.1.1

General host information:

Vulnerability information:

Appendix D

Vulnerability List by Severity

Root Access via Buffer Overflow (RED)

Target for Abuse(YELLOW)

Possible Vulnerabilities (BROWN)

Appendix E

Vulnerability Tutorials

Tutorial: Potentially_Vulnerable_Web_Server.html

Vulnerable Web Server

Impact

Background

Resolution

CVE References(s):

Tutorial: rpc_statd_access.html

rpc.statd access

Summary

Impact

The problem

Fix

Other tips

CVE References(s):

Tutorial: sgi_fam_version.html

SGI_FAM Version

Summary

Impact

The Problem

Fix

Reference(s):

CVE References(s):

Tutorial: SMTP_could_be_a_mail_relay.html

Mail Relay Problem

Impact

Background

Resolution

Tutorial: SMTP_may_be_a_mail_relay.html

Mail Relay Problem

Impact

Background

Resolution

Tutorial: SSH_vulnerabilities.html

SSH Agent Vulnerabilities

Impact

The Problem

Resolutions

References

CVE References(s):