exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Corsaire Security Advisory 2003-11-20.1

Corsaire Security Advisory 2003-11-20.1
Posted Aug 11, 2004
Authored by Martin O'Neal, Corsaire | Site corsaire.com

Corsaire Security Advisory - Sygate Enforcer 4.0 and prior releases are susceptible to a denial of service attack via malformed discovery packets.

tags | advisory, denial of service
advisories | CVE-2003-0931
SHA-256 | c0ffd3b2d0fc4b2f508557dda3a080b8daea38175bc4d73cf4d1a38f69678dee

Corsaire Security Advisory 2003-11-20.1

Change Mirror Download

-- Corsaire Security Advisory --

Title: Sygate Enforcer discovery packet DoS issue
Date: 20.11.03
Application: Sygate Enforcer 4.0 and prior
Environment: Windows NT, 2000, 2003
Author: Martin O'Neal [martin.oneal@corsaire.com]
Audience: General distribution
Reference: c031120-001


-- Scope --

The aim of this document is to clearly define an issue that exists with
the Sygate Enforcer product [1] that will allow a remote attacker to
provoke a DoS condition.


-- History --

Discovered: 20.11.03 (Martin O'Neal)
Vendor notified: 14.01.04
Document released: 10.8.04


-- Overview --

Sygate Enforcers are described as [2] "network gateway devices that
enforce host integrity at network access points". Architecturally they
function as an authenticated, packet-filtering firewall device. The
Enforcer interacts with the Sygate Security Agent (SAA [the personal
firewall component]) product and limits access to protected
networks/hosts to authenticated clients that comply with a predefined
policy.

In practise, the Enforcer device uses a number of proprietary protocol
exchanges to communicate with other Enforcers and also the SAA product.
By sending a packet containing a malformed payload to the Enforcer, the
host service can be forced to stop responding.


-- Analysis --

The Sygate Enforcer product sends a discovery packet at one-second
intervals on all interfaces that have IP bound to them. The packet is a
UDP datagram, from source port 39999 to destination port 39999, and is
sent to the local subnet broadcast address.

If this packet is malformed and replayed to the Enforcer, it will cause
the Enforcer service to stop unexpectedly, without generating an entry
within the product's audit trail.

It is worth noting that the packet that is replayed does not need to be
sent to the local subnet broadcast address, and can be happily sent to
any valid unicast address associated with the Enforcer. This means that
the attacker does not need to be local to the Enforcer to exploit this
issue.


-- Recommendations --

The Enforcer product should be upgraded to a version that is not
susceptible to this issue.


-- Background --

This issue was discovered using a custom protocol analysis tool
developed by Corsaire's security assessment team. This tool is not
available publicly, but is an example of the specialist approach used by
Corsaire's consultants as part of a commercial security assessment. To
find out more about the cutting edge services provided by Corsaire
simply visit our web site at http://www.corsaire.com


-- CVE --

The Common Vulnerabilities and Exposures (CVE) project has assigned
the name CAN-2003-0931 to this issue. This is a candidate for
inclusion in the CVE list (http://cve.mitre.org), which standardises
names for security problems.


-- References --

[1] http://www.sygate.com
[2] http://www.sygate.com/products/universal_enforcement.htm


-- Revision --

a. Initial release.
b. Minor revisions.


-- Distribution --

This security advisory may be freely distributed, provided that it
remains unaltered and in its original form.


-- Disclaimer --

The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise. Corsaire
accepts no responsibility for any damage caused by the use or misuse of
this information.


-- About Corsaire --

Corsaire are a leading information security consultancy, founded in 1997
in Guildford, Surrey, UK. Corsaire bring innovation, integrity and
analytical rigour to every job, which means fast and dramatic security
performance improvements. Our services centre on the delivery of
information security planning, assessment, implementation, management
and vulnerability research.

A free guide to selecting a security assessment supplier is available at
http://www.penetration-testing.com


Copyright 2004 Corsaire Limited. All rights reserved.



Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close