Advisories: August 25, 2005

Astaro Security Linux

Astaro Security Linux 6.0 – HTTP CONNECT
Access Localhost Weakness

Product:

Astaro Security Linux 6.0 is a network security solution,
including a combination of the following security applications:

Stateful inspection firewall with application proxies
VPN
AV
IDS
AntiSpam
ContentFilter

A proxy is running on Port 8080/TCP, accepting HTTP CONNECT
requests destinated to localhost. Therefore it is f.e. possible to
connect to the installed HTTPd, running on localhost. Other
scenarios like connecting to the SSH-Admin port are possible,
depending on the configuration of the allowed destination ports for
the CONNECT method.

Exploiting

No exploit required. Simply netcat to the proxy port and enter
the following command:

CONNECT localhost:80 HTTP/1.0

MISC

In addition i found some other, interesting issues, which can be
security relevant, depending on the usage of the product:

1) Sending an invalid, unauthenticated request (“CONNECT
localhost 21 HTTP/1.0”) to the proxy port delivers the following
information:

“Proxy-authorization: Basic LTpwcHBwCg==”

as part of the proxy response.

The string can also be found hardcodet in the binary
“/var/storage/chroot-http/usr/bin/hyperdyper”.

This login-credentials are used internaly by the Content Filter
Framework.

2) Astaro can be configured using Webmin. Due to a directory
traversal vuln. is it possible for authenticated webmin users to
access files on the filesystem, which are not accessible via the
webmin-gui, and should only be accessable by console-users:

GET
/index.fpl?SID=1497553306006&id=0555&frameset=active&wfe_download=/../../etc/passwd&fname=MeinePasswd&mime_type=application%2foctet%2dstream
HTTP/1.1

3) If an administrator is logged in via webmin, and another
administrator is logging in, the new admin can disconnect/kick the
currently logged in one. Thereby it is possible to supply a
message, that will be automaticly displayed at the kicked admins
browser. However, supplying Script-Code instead of a message leads
to an automated execution of the code in the kicked admins
browser.

So, not realy risky but shows missing input filtering.

Its up to the reader to deside about the risk level of 1-3. I
just sent this information for completeness.

Version

The vulnerable version of the product is 6.0.0.1

Solution

Upgrade to version 6.0.0.2
Upgrade is available at the vendors website.

Vendor

http://www.astaro.com

Astaro respondet very fast, and was very cooperative. Fixes were
delivered within a day after informing.

Discovered

oliver karow
10.08.2005
http://www.oliverkarow.de/research/astaro.txt

Debian GNU/Linux

Debian Security Advisory DSA 784-1 [email protected]
http://www.debian.org/security/
Martin Schulze
August 25th, 2005 http://www.debian.org/security/faq

Package : courier
Vulnerability : programming error
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2005-2151
Debian Bug : 320290

A problem has been discovered in the Courier Mail Server. DNS
failures were not handled properly when looking up Sender Policy
Framework (SPF) records, which could allow attackers to cause
memory corruption. The default configuration on Debian has SPF
checking disabled, so most machines are not vulnerable. This is
explained in the “courier” manpage, section SENDER POLICY FRAMEWORK
KEYWORDS.

The old stable distribution (woody) is not affected by this
problem.

For the stable distribution (sarge) this problem has been fixed
in version 0.47-4sarge1.

For the unstable distribution (sid) this problem has been fixed
in version 0.47-6.

We recommend that you upgrade your courier-mta package.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages