Internet Security Systems Security Advisory August 6, 2001 Multiple Buffer Overflow Vulnerabilities in Raytheon SilentRunner Synopsis: Internet Security Systems (ISS) X-Force in conjunction with ISS Emergency Response Services (ERS) has discovered and researched remote vulnerabilities in Raytheon SilentRunner. SilentRunner is a passive network monitoring, discovery and analysis tool. The SilentRunner collector module is the passive network monitoring component of the program. The collector contains multiple buffer overflow vulnerabilities that may be exploited by an attacker on networks monitored by SilentRunner. Successful exploitation can result in a Denial of Service (DoS) attack against the collector, or execution of arbitrary code on the SilentRunner server. Affected Versions: Raytheon SilentRunner 2.0 Raytheon SilentRunner 2.0.1 It is unknown at this time if previous versions of SilentRunner are affected by the vulnerabilities described in this advisory. ISS X-Force recommends that SilentRunner customers contact Raytheon to determine if previous versions are vulnerable. Description: SilentRunner is an advanced network analysis system built on top of a passive network monitoring engine. The collector monitors and records network traffic for use within other portions of SilentRunner. SilentRunner can view network activity through its own collector, or import network data from various other sources. Multiple buffer overflow vulnerabilities exist in the collector (cle.exe) component of SilentRunner. The routines that parse passwords for many common protocols such as POP, HTTP, FTP, etc., do not perform necessary bounds checking on user-supplied passwords. It is possible for any user on any network monitored by a SilentRunner collector to craft long strings that will crash the collector and possibly execute arbitrary code on any system running the SilentRunner collector. An additional buffer overflow vulnerability exists in the SilentRunner "Knowledge Browser", a traffic analysis component of SilentRunner. The Knowledge Browser does not perform adequate bounds checking on certain long HTTP queries. Any user on a SilentRunner monitored network may craft a long HTTP query, which will be recorded by the SilentRunner collector. If the long HTTP query is processed by the Knowledge Browser, malicious code may be executed on the SilentRunner server. Before the Knowledge Browser can process traffic from the Silent Runner collector, it must be manually started by a SilentRunner operator. Recommendations: Raytheon is aware of the vulnerabilities described in this advisory. SilentRunner version 2.0 is vulnerable to all issues described in this advisory. SilentRunner version 2.0.1 contains fixes for the long password overflow vulnerabilities described above. SilentRunner 2.0.1 remains vulnerable to the long HTTP issue. ISS X-Force will provide detection and assessment support for these vulnerabilities in upcoming X-Press Updates for RealSecure Network Sensor and Internet Scanner. Additional Information: The Common Vulnerabilities and Exposures (CVE) project has assigned the Name CAN-2001-0636 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. Credits: ISS X-Force would like to thank John Ventura of ISS ERS for discovering this vulnerability. ______ About Internet Security Systems (ISS) Internet Security Systems is a leading global provider of security management solutions for the Internet, protecting digital assets and ensuring safe and uninterrupted e-business. With its industry-leading intrusion detection and vulnerability assessment, remote managed security services, and strategic consulting and education offerings, ISS is a trusted security provider to more than 8,000 customers worldwide including 21 of the 25 largest U.S. commercial banks and the top 10 U.S. telecommunications companies. Founded in 1994, ISS is headquartered in Atlanta, GA, with additional offices throughout North America and international operations in Asia, Australia, Europe, Latin America and the Middle East. For more information, visit the Internet Security Systems web site at www.iss.net or call 888-901-7477. Copyright (c) 2001 Internet Security Systems, Inc. Permission is hereby granted for the redistribution of this Alert electronically. It is not to be edited in any way without express consent of the X-Force. If you wish to reprint the whole or any part of this Alert in any other medium excluding electronic medium, please e-mail xforceat_private for permission. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. X-Force PGP Key available at: http://xforce.iss.net/sensitive.php as well as on MIT's PGP key server and PGP.com's key server. Please send suggestions, updates, and comments to: X-Force xforceat_private of Internet Security Systems, Inc.
This archive was generated by hypermail 2b30 : Mon Aug 06 2001 - 14:41:03 PDT