FOR YOUR INFORMATION ONLY Herewith response from Trend Micro re message received from Karl C. on behalf of Lherisson dated Monday 14 June 1999. SYLVIA sylviaat_private -----Original Message----- From: Paullin Lin [mailto:Paullin_Linat_private] Sent: Wednesday, June 16, 1999 6:25 AM To: 'sylviaat_private' Subject: FW: Possible Security Flaw in Trend Micro's InterScan FTP Proxy Dear Sylvia, Following is the comment from our PM, for your reference. Best Regards Paullin -----Original Message----- From: Mark Shih Sent: Tuesday, June 15, 1999 7:10 PM To: Paullin Lin Subject: RE: Possible Security Flaw in Trend Micro's InterScan FTP Proxy The InterScan FTP stand alone mode is expecting the firewall to do the IP filter for the security concern. Mark -----Original Message----- From: Paullin Lin Sent: Tuesday, June 15, 1999 3:53 PM To: Mark Shih Subject: FW: Possible Security Flaw in Trend Micro's InterScan FTP Proxy Importance: High Dear Mark, As Anthony is out of office, can I have your comments on this? Thanks. Best Regards Paullin -----Original Message----- From: sylviam [mailto:sylviaat_private] Sent: Tuesday, June 15, 1999 3:17 PM To: Paullin_Linat_private Cc: imelamedat_private Subject: FW: Possible Security Flaw in Trend Micro's InterScan FTP Proxy Importance: High Dear Paullin Any comments? SYLVIA sylviaat_private -----Original Message----- From: Bugtraq List [mailto:BUGTRAQat_private] On Behalf Of Lherisson, Karl C. Sent: Monday, June 14, 1999 11:47 PM To: BUGTRAQat_private Subject: Possible Security Flaw in Trend Micro's InterScan FTP Proxy Hi my name is Karl C. Lherisson a network consultant at a securities firm. I am writing to inform you that I recently purchased Trend Micro's InterScan product for its ability to scan email for viruses and to prevent SPAM from being relayed of our SMTP server. I also decided to look into the FTP proxy feature that is included but I found a possible security hole in the product. When using InterScan version 3.0 as a stand alone proxy there is no way to limit who can have access to the FTP proxy. Unlike the SMTP portion, where one can specify valid source IP addresses that are able to relay mail, anyone on the Internet who knows the IP address of the InterScan FTP proxy can use it to log onto another network and basically hide their identity. So if I were a "hacker" and I wanted to launch an FTP attack on lets say COMPANY A, and I know there is a Trend Micro InterScan FTP Proxy server at COMPANY B, well I would login to COMPANY B proxy server and then connect to COMPANY A. What makes matters worse is that InterScan 3.0 does not keep a log of FTP connections (basically making the hacker anonymous), and the software will perform the job of checking the hacker's files for viruses. Additionally, if COMPANY A found out that they were infiltrated in some way, it would appear that it originated from COMPANY B. Fortunately, the FTP Proxy Server can be disabled but this kills 1/3 of the product functionality. - Karl C. Lherisson karlat_private Network Consultant
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:50:45 PDT