iDEFENSE Security Advisory 08.08.2002 iSCSI Default Configuration File Settings DESCRIPTION iSCSI is a popular new protocol that allows the SCSI protocol to be used over traditional IP networks. This allows for SAN like storage arrays without requiring new network infrastructure. iSCSI’s primary authentication mechanism for users is the CHAP protocol (Challenge Handshake Authentication Protocol), which is very resilient against replay attacks and provides strong protection for the user’s password. The CHAP protocol requires the user’s password to connect, and in order to automate this process the user must provide the cleartext password to the system that is then stored, typically in cleartext, so that it will be accessible when needed. Care must be taken to ensure configuration files containing the cleartext password are properly protected. For more information on the CHAP protocol please see RFC 1994. The primary iSCSI implementation for Linux, “Linux-iSCSI” is a freely available software package primarily maintained by Cisco Systems. This package stores it primary configuration directives in the file: /etc/iscsi.conf This file is created world writeable by default and no mention is made in the file of the importance of protecting it from being read by attackers. At least one vendor has shipped this file world readable in the default configuration of a beta release of an operating system, when notified they stated it would be fixed in the release version of the operating system. ANALYSIS Any authentication systems that require cleartext passwords to be stored should be carefully audited to ensure that passwords are properly protected. This problem can also potentially affect numerous packages, ranging from NTP and BIND to iSCSI all of which require stored passwords or secrets. DETECTION Check the permissions on the file: /etc/iscsi.conf The file should be owned by the user and group root, and only the root user should be granted read and write access to the file, all other permissions should be removed (i.e. file permissions should be 0400) VENDOR RESPONSE Red Hat has confirmed that the file /etc/iscsi.conf was set world readable in the Limbo Beta, and that it will be fixed in the next release version of Red Hat Linux. SuSE has confirmed that the file permissions are set correctly on /etc/iscsi.conf. No other major Linux vendors appear to be shipping the iSCSI package yet. DISCOVERY CREDIT Kurt Seifried (kurtat_private) DISCLOSURE TIMELINE July 11, 2002: Problem found on Red Hat Linux Limbo Beta #1 Initial contacts sent to Red Hat, SuSE and Cisco July 12, 2002: SuSE confirms file mode 600 by default, not vulnerable Email sent to Matthew Franz at Cisco, additional Cisco employees also contacted, iSCSI for Linux is an external project at Cisco, PSIRT was not used, no response ever received. July 17, 2002: iDEFENSE client disclosure July 29, 20022: Problem confirmed in Red Hat Limbo Beta #2, Red Hat contacted again, no response received. August 6, 2002: No update of Linux iSCSI, nor mention of problem on website. August 8, 2002: Public Advisory http://www.idefense.com/contributor.html David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 dendlerat_private www.idefense.com
This archive was generated by hypermail 2b30 : Thu Aug 08 2002 - 07:38:26 PDT