Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2006.0518 -- [Win][Linux][Solaris][AIX]
Protocol Parsing Bug in SMB Mailslot Parsing in ISS Products
28 July 2006
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: RealSecure Network/Server/Desktop Sensor 7.0
Proventia A/G/M Series
Proventia Server and Desktop
BlackICE Server and PC Protection 3.6
Publisher: ISS
Operating System: AIX
HP-UX
Solaris
Linux variants
Windows
Impact: Denial of Service
Access: Remote/Unauthenticated
CVE Names: CVE-2006-3840
Original Bulletin: http://xforce.iss.net/xforce/alerts/id/230
- --------------------------BEGIN INCLUDED TEXT--------------------
Internet Security Systems Security Alert
July 26, 2005
Protocol Parsing Bug in SMB Mailslot Parsing in ISS Products
Version: 1.0
CVSS Score:
Access Vector: Remote
Access Complexity: High
Authentication: Not Required
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: Complete
Impact Bias: Availability
Base Score: 2
Exploitability: Proof of concept
Remediation Level: Official Fix
Report Confidence: Confirmed
Temporal: 1.6
Synopsis:
A protocol parsing bug was discovered within ISS July 2006 XPU
SMB_MailSlot_Heap_Overflow decode. This decode is designed to provide
protection for the Microsoft SMB/TCP Mailslot vulnerability (MS06-035),
but can be adversely affected by certain types of legitimate SMB Mailslot
network traffic. In the worst case scenario, some host-based protection
products will suffer from a denial of service.
Affected Versions:
See knowledgebase article:
https://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_faqid=3630
Impact:
The protocol parsing bug is caused by incorrect parsing of SMB/TCP
Mailslot information. The flaw may be triggered by certain types of
legitimate SMB Mailslot traffic. ISS X-Force has confirmed that
exploitation of this issue, which results in remote access, is NOT possible;
however, it can cause a denial of service. In the worst case scenario,
host-based products will loose network connectivity requiring a host restart.
Description:
ISS July XPUs provided virtual patch protection for Microsofts MS06-035
vulnerability. However, a bug in the logic for the virtual patch decode,
SMB_MailSlot_Heap_Overflow, may be triggered when encountering certain
types of legitimate SMB Mailslot traffic, which would result in the protocol
analysis module (PAM) engine not responding to subsequent network
traffic. This denial of service is managed differently by each
ISS product that utilizes PAM. It is important to note that PAM will
successfully protect against possible exploit attempts of the SMB
Mailslot vulnerability (MS06-035).
The default affect of the protocol parsing bug in the ISS protection products
is dependant upon the protection platform. An ISS knowledgebase has
been produced, which details how each protection product handles the
bug, can be found at:
https://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_faqid=3630
Mitigating Factors:
* Firewall best practices and standard default firewall configurations
can help protect networks from attacks that originate outside the enterprise
perimeter. Best practices recommend that systems that are connected to the
Internet have a minimal number of ports exposed. In particular blocking
TCP port 445 at the firewall will help protect systems that are behind
that firewall from attempts to exploit this vulnerability.
* Microsoft Windows XP Service Pack 2 and Microsoft Windows Server 2003
Service Pack 1 do not have services listening on Mailslots in default
configurations.
Recommendations:
ISS X-Force recommends that customers immediately update to the newest
XPU provided by ISS. These XPUs contains a fix for this vulnerability.
ISS has already made the following updates available to remedy this
vulnerability:
RealSecure Network 7.0, XPU 24.40
Proventia A Series, XPU 24.40
Proventia G Series, XPU 24.40/1.79
Proventia M Series, XPU 1.79
RealSecure Server Sensor 7.0, XPU 24.40
Proventia Server 1.0.914.1880
RealSecure Desktop 7.0 epk
Proventia Desktop 8.0.812.1790/8.0.675.1790
BlackICE PC Protection 3.6 cpk
BlackICE Server Protection 3.6 cpk
Updates are available from the ISS Download Center:
http://www.iss.net/download/
As a temporary workaround while the updates are being applied and as a
general security best-practice, it is recommended that SMB traffic be
blocked at network perimeters.
Additional Information:
http://www.nsfocus.com
Credit:
ISS X-Force would like to thank the NSFOCUS Security Team for notifying ISS
of the issue.
______
About Internet Security Systems, Inc.
Internet Security Systems, Inc. (ISS) is the trusted security advisor to
thousands of the world's leading businesses and governments, providing
preemptive protection for networks, desktops and servers. An established
leader in security since 1994, ISS' integrated security platform
automatically protects against both known and unknown threats, keeping networks
up and running and shielding customers from online attacks before they
impact business assets. ISS products and services are based on the proactive
security intelligence of its X-Force research and development team - the
unequivocal world authority in vulnerability and threat research. ISS'
product line is also complemented by comprehensive Managed Security Services.
For more information, visit the Internet Security Systems Web site at
www.iss.net or call 800-776-2362.
Copyright (c) 2006 Internet Security Systems, Inc. All rights reserved
worldwide.
This document is not to be edited or altered in any way without the
express written consent of Internet Security Systems, Inc. If you wish
to reprint the whole or any part of this document, please email
xforce@iss.net for permission. You may provide links to this document
from your web site, and you may make copies of this document in
accordance with the fair use doctrine of the U.S. copyright laws.
Disclaimer: The information within this paper may change without notice.
Use of this information constitutes acceptance for use in an AS IS condition.
There are NO warranties, implied or otherwise, with regard to this information
or its use. Any use of this information is at the user's risk. In no event
shall the author/distributor (Internet Security Systems X-Force) be held
liable for any damages whatsoever arising out of or in connection with the
use or spread of this information.
X-Force PGP Key available on MIT's PGP key server and PGP.com's key
server, as well as at http://www.iss.net/security_center/sensitive.php
Please send suggestions, updates, and comments to: X-Force
xforce@iss.net of Internet Security Systems, Inc.
Revisions:
Version 1.0 July 25, 2006 - Initial alert release
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBRMmUeCh9+71yA2DNAQJiHAP9FURSFToxX+y/t9KS9vtrSkXOMcgimsBn
OMge+h/gQayArF4IZG3oPNYJ6FJFBSFlrRgxsxU4jTBIy074b1lcV3NdXureWend
mu0+VbTWefKczSrmOtnz6M6ispzkXha9ZrwFJSGHZw3KekpAb6uxGfsPv2jnjQIh
4lfGBHMubEs=
=jGbH
-----END PGP SIGNATURE-----