Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
WatchGuard Firebox Vclass and RapidStream Appliance Input Validation Bugs May Give Remote Users Root Access
|
|
SecurityTracker Alert ID: 1005307 |
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Sep 27 2002
|
Impact: Execution of arbitrary code via network, Root access via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): Firebox Vclass V100, V80, V60, and V10; RapidStream RSSA 8000, 6000, 4000, 2000, 1000, and 500
|
Description: Several input validation vulnerabilities were reported in the WatchGuard Firebox Vclass and (legacy) RapidStream appliances. A remote user could gain root access on the appliance.
Several input validation holes in the firewall's commmand line interface are reported.
According to the report, a modified version
of OpenSSH is used to provide remote access to the command line. Apparently, user-supplied information is passed by this modified
version to the command line interface (CLI) wrapper (/bin/cli) before authentication occurs. Then, the CLI wrapper passes the user-supplied
parameters to the CLI binary, which atttempts to peform authentication by launching "/bin/.cli -p <password>".
It is reported
that there is a format string flaw in processing the password parameter, allowing a remote user to gain root access on the firewall
appliance.
Also, user-supplied input is not properly validated by the CLI. A remote user could avoid being logged out after
authentication failure when a '-n' ("execute no remote command") option is used with SSH login, giving the remote user a CLI prompt
with administrative privileges.
This flaw reportedly affects the current version of Vclass software, as well as legacy RapidStream
appliances.
|
Impact: A remote user can gain root access on the firewall appliance.
|
Solution: According to the report, WatchGuard has issued RS-302-HotFix-31 for 3.02 SP2 and Hotfix 2 for 3.2 SP1, available at:
http://watchguard.com/vars/rssa.asp
|
Vendor URL: www.watchguard.com/ (Links to External Site)
|
Cause: Input validation error
|
Reported By: Joao Gouveia <tharbad@kaotik.org>
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: 27 Sep 2002 04:22:27 +0100
From: Joao Gouveia <tharbad@kaotik.org>
Subject: [Full-Disclosure] Watchguard firewall appliances remote vulnerabilities
|
--=-2iFYH9NR5KiCUBnXzzEV
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
Scope: WatchGuard Firewall Appliances.
Vendor: WatchGuard Technologies, Inc ( http://www.watchguard.com ).
Affected:
Vclass appliances running the current version of Vclass software.
Legacy RSSA appliances running Vclass software.
Legacy RSSA appliances that have not yet upgraded to Vclass software.
Risk: Critical
Timeline:
Aug 22/2002 - First contact with Rapid Response Team.
Sep 04/2002 - Sent a working exploit.
Sep 12/2002 - Received a working Hotfix for RSSA 1000/6000.
Sep 27/2002 - Public release.
Description: Multiple remote input validation vulnerabilities in the
command line interface that could be exploited to gain root level access
to the appliance.
Details:
The RapidStream login procedure works as follows:
- Hacked openssh binary receives authentication parameters from client,
not doing any authentication, rather than confirming that the username
used is "rsadmin".
- The password passed on the SSH login is sent as a parameter to the CLI
wrapper (/bin/cli)
- The CLI wrapper passes the parameters to the CLI binary, wich proceeds
with the authentication, by launching "/bin/.cli -p <password>"
Both issues relay on the fact that SSH doesn't do any type of real
authentication, wich allows any outside user to execute the CLI binary,
depending only that the username should be "rsadmin", wich is equivalent
to the 'root' user on this Linux based appliance.
Issue 1: "Format Strings" vulnerability on the password parameter allows
an attacker to remotely compromise the firewall appliance.
Issue 2: The CLI doesn't properly check for user input, wich could allow
an attacker to avoid beeing logged out after the authentication fails,
leaving the attacker in the CLI prompt with administrative priviledges.
Rapid Response Team issued RS-302-HotFix-31 for 3.02 SP2 and Hotfix 2
for 3.2 SP1, wich should be available at
http://watchguard.com/vars/rssa.asp, along with information on this
issues.
Acknowledgments:
Steve Fallin <Steve.Fallin@watchguard.com> - For coordinating this
issues with the Rapid Response Team.
Rodrigo Cunha <rnbc@netcabo.pt> - For reminding me of the obvious.
Best regards,
Joao Gouveia
------------
tharbad@kaotik.org
--=-2iFYH9NR5KiCUBnXzzEV
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (GNU/Linux)
iD8DBQA9k87zBhvB6ogSmsoRAkTfAJ90aePM+NqVhkUMLWoXmxu+OlFEXgCfY+g3
BFlfpxB6Ht0MMZlskPfBWE8=
=1ytI
-----END PGP SIGNATURE-----
--=-2iFYH9NR5KiCUBnXzzEV--
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
|
|
Go to the Top of This SecurityTracker Archive Page
|
