-----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Security Advisory April 30, 2002 Remote Denial of Service Vulnerability in RealSecure Network Sensor Synopsis: ISS X-Force has learned of a denial of service (DoS) vulnerability that affects Internet Security Systems RealSecure Network Sensor. This vulnerability may allow remote attackers to crash RealSecure by sending specially crafted packets to network segments monitored by RealSecure. RealSecure X-Press Update 4.3 contains a fix for the DHCP vulnerability and is available for immediate download on the ISS download center. Affected Versions: RealSecure Network Sensor 5.x, XPU 3.4 and later RealSecure Network Sensor 6.0, XPU 3.4 and later RealSecure Network Sensor 6.5 Description: RealSecure Network Sensor has three informational signatures associated with DHCP (Dynamic Host Configuration Protocol): DHCP_ACK (7131), DHCP_Discover (7132), and DHCP_Request (7133). These signatures contain a flaw that will result in an illegal attempt to de-reference a null memory pointer when RealSecure detects certain types of DHCP traffic. This action may generate an exception error or a segmentation fault which can cause the RealSecure sensor to crash. This vulnerability was introduced in RealSecure Network Sensor 6.5. XPU 3.4 delivered the vulnerable DHCP signatures to older RealSecure product lines including 6.0 and 5.x. It may be possible for remote attackers to create specially-crafted DHCP traffic to cause the sensor to malfunction or crash entirely. The three DHCP signatures were disabled by default in Network Sensor 5.x and 6.0. The signatures were enabled by default in Network Sensor 6.5 within the "Maximum" policy. However, if these signatures are not enabled, RealSecure Network Sensor is not vulnerable to these attacks. Recommendations: X-Force recommends that all RealSecure customers tune their policies to their environments. RealSecure X-Press Update 4.3 contains a fix for the DHCP vulnerability. X-Press Update 4.3 is available for download on the ISS download center: http://www.iss.net/download/. DHCP traffic is commonly blocked at perimeter firewalls. Network administrators are advised to assess their network perimeter defenses routinely. Exploitation of this vulnerability is blocked by proper filtering of DHCP traffic on UDP port 67. ______ About Internet Security Systems (ISS) Founded in 1994, Internet Security Systems (ISS) (Nasdaq: ISSX) is a pioneer and world leader in software and services that protect critical online resources from an ever-changing spectrum of threats and misuse. Internet Security Systems is headquartered in Atlanta, GA, with additional operations throughout the Americas, Asia, Australia, Europe and the Middle East. Copyright (c) 2002 Internet Security Systems, Inc. All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this document. It is not to be edited or altered in any way without the express written consent of the Internet Security Systems X-Force. If you wish to reprint the whole or any part of this document in any other medium excluding electronic media, please email xforceat_private for permission. Disclaimer: The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information. X-Force PGP Key available on MIT's PGP key server and PGP.com's key server, as well as at http://www.iss.net/security_center/sensitive.php Please send suggestions, updates, and comments to: X-Force -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBPM7pJjRfJiV99eG9AQHBBAQAmh7q8UVXJcdNbSpuiSA0oyVSgLhqc1O2 bQyGOeNbbWhTLWQ3pMzcBjx4vjTE34dI4T4OT7PLlGVuvcW4fLG70Lq+Fsr34gQj E17UWKvqvD+AUXvcMq0gxjV15uykkmhy01zZ+Cwn5LsjWXjzpy4r/a7OzZ13Lzrq u7+bVixmr70= =m3XN -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Tue Apr 30 2002 - 13:57:31 PDT