('binary' encoding is not supported, stored as-is) Product: [Fourelle|Venturi Wireless] Venturi Client (all versions prior to 2.2) Brief Description: Acts as an open proxy for protocols including SMTP. Description: Venturi Client is a multi-protocol proxy that operates in conjunction with a proprietary transcoding server. It inserts itself into the networking stack in order to transparently intercept network requests. In versions prior to 2.2 remote machines are able to proxy just about anything through the system. Although it can be used for more, the only wild attack I have detected was by a spammer looking to make an open SMTP relay. (Several hundred thousand spams were sent in the two hours it took to detect and disconnect the compromised machine.) Recommended actions: 1] Uninstall the product. Removing the front end GUI from the startup menu is not sufficient. 2] Upgrade from v2.1 to 2.2 using the now released patch: http://www.venturiwireless.com/tech_support/Q_and_A/Q_A_09.htm 3] Use a firewall to prevent outside connections to machine. Distributed by: Verizon Wireless as part of their Mobile Office package. The company also claim partnership with Motorola, Sierra Wireless, Telus, Bell Mobility, CommWorks (3Com) and DDI Pocket. I believe that enterprises can also purchase this product directly. Company Reaction: Venturi Wireless knew of this flaw and had an unpublished patch as of my initial contact on the 12th of May. It is unclear how long they have known about it. They claimed it had not been found to be used in the wild. We negotiated that they would publicly release information by the 16th in return for a couple days to write up a notice. They have now posted the patch, with no details, at http://www.venturiwireless.com/tech_support/Q_and_A/Q_A_09.htm There is as of yet no link on their site to this page, and I suspect it will be buried when there is. Given the severity of this vulnerability I am posting this to some appropriate newsgroups and bugtraq. Josh Steinhurst Department of Computer Science University of North Carolina at Chapel Hill
This archive was generated by hypermail 2b30 : Fri May 16 2003 - 13:45:14 PDT