Onderwerp: Astaro Security Linux Firewall - HTTP Proxy vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Greetings!

A quite well known (i.e. ancient) type of proxy vulnerability was
found in the https proxy of Astaro Security Linux firewall (which is
a chrooted yet plain squid btw.) This general problem has been known
to be an issue with nearly all HTTP proxies for ages (e.g.
http://www.squid-cache.org/Doc/FAQ/FAQ-10.html#ss10.14).

The vulnerability can be exploited using the CONNECT method to
connect to a different server, e.g. an internal mailserver as port
usage is completely unrestricted by the Astaro proxy.

Example:
you = 6.6.6.666
Astaro = 1.1.1.1 (http proxy at port 8080)
Internal Mailserver = 2.2.2.2

connect with "telnet 1.1.1.1 8080" to Astaro proxy and enter
CONNECT 2.2.2.2:25 / HTTP/1.0

response: mail server banner - and running SMTP session e.g.
to send SPAM from.

You can connect to any TCP port on any machine the proxy can connect
to. Telnet, SMTP, POP, etc.


Solution:

Install patch 3.215 - there you can restrict the ports you allow
access to. I'd suggest ports 21 70 80 443 563 210 1025-65535 which
stand for FTP, Gopher, HTTP, HTTPS, HTTPS(seldom), WAIS and
nonprivileged services (e.g. passive FTP)


Volker Tanger
IT-Security Consulting

- --
discon gmbh
Wrangelstraße 100
D-10997 Berlin

fon +49 30 6104-3307
fax +49 30 6104-3461

volker.tanger@discon.de
http://www.discon.de/


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (MingW32) - WinPT 0.5.5

iD8DBQE+K7um0uordLlMxo4RAuP2AJwKDWUC0ruCMgr4lsmQMw rr2aZOXQCeOHdN
LhhcvkURae1erxD3tN59SlQ=
=arTl
-----END PGP SIGNATURE-----

Bugtraq: Astaro Security Linux Firewall - HTTP Proxy vulnerability


Vulnerability description:
-------------------------
The HTTP proxy can be used to connect to any TCP port
and not only to certain 'safe' ports.

The vulnerability only takes effect for clients that have
allowed access to the proxy.

In standard mode, only host defined in the allowed networks list of=20
the HTTP proxy has been able to use this flaw. In user authentication=20
mode, only host defined in the allowed networks list and after a=20
correct user authentication has been able to use this flaw.
In transparent mode, hosts were not able to use this flaw.

Per default the HTTP proxy is disabled and the allowed networks list is =
empty.=20

At any given time there was no vulnerability of system
itself, neither a remote exploit giving unprivileged users=20
access to the system.

Impact:
-------
The allowed users have been able to connect to any tcp port in the =
internet=20
and therefore bypass the security policy defined in the packet filter.

Advice:
-------
Please make sure that only trusted/internal networks are
selected in the allowed networks list of the HTTP proxy.
This prevents abuse of the proxy from the outside/internet.

Fix Description:
----------------
To fix this issue a new Configuration option has been added
to HTTP proxy configuration menu, giving you the ability to=20
configure the services which are allowed to use through the=20
HTTP proxy .

Per default we added the following services:
- HTTP
- HTTPS
- LDAP
- FTP_CONTROL
- SQUID

Vulnerable Versions:
--------------------
Astaro Security Linux 2.0 prior version 2.031
Astaro Security Linux 3.2 prior version 3.214

Bugfixed in version:
--------------------
Up2Date Package 2.032 (released Jan, 21st, 2003)
Up2Date Package 3.215 (released Jan, 17th, 2003)

Please update your system to latest version available.

Astaro Security Team

Visit Astaro at:
- Infosecurity Italia 2003, Milano, Feb. 12 - 14, 2003
- Infosecurity Belgium 2003, Brussels, Feb. 26 - 27, 2003
- NetworkWorld Technical Seminar "VPN", Offenbach, Feb. 26.-27. 2003
- CeBIT 2003, Hannover, Mar. 12.-19, 2003
- Infosecurity Europe, London, Apr. 29 - May 1, 2003


> -----Original Message-----
> From: Volker Tanger [mailto:volker.tanger@discon.de]
> Sent: Monday, January 20, 2003 10:05 AM
> To: bugtraq@securityfocus.com
> Subject: Astaro Security Linux Firewall - HTTP Proxy vulnerability
>=20
>=20
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>=20
>=20
> Greetings!
>=20
> A quite well known (i.e. ancient) type of proxy vulnerability was
> found in the https proxy of Astaro Security Linux firewall (which is
> a chrooted yet plain squid btw.) This general problem has been known
> to be an issue with nearly all HTTP proxies for ages (e.g.
> http://www.squid-cache.org/Doc/FAQ/FAQ-10.html#ss10.14).
>=20
> The vulnerability can be exploited using the CONNECT method to
> connect to a different server, e.g. an internal mailserver as port
> usage is completely unrestricted by the Astaro proxy.
>=20
> Example:
> you =3D 6.6.6.666
> Astaro =3D 1.1.1.1 (http proxy at port 8080)
> Internal Mailserver =3D 2.2.2.2
>=20
> connect with "telnet 1.1.1.1 8080" to Astaro proxy and enter
> CONNECT 2.2.2.2:25 / HTTP/1.0
>=20
> response: mail server banner - and running SMTP session e.g.
> to send SPAM from.
>=20
> You can connect to any TCP port on any machine the proxy can connect
> to. Telnet, SMTP, POP, etc.
>=20
>=20
> Solution:
>=20
> Install patch 3.215 - there you can restrict the ports you allow
> access to. I'd suggest ports 21 70 80 443 563 210 1025-65535 which
> stand for FTP, Gopher, HTTP, HTTPS, HTTPS(seldom), WAIS and
> nonprivileged services (e.g. passive FTP)
>=20
>=20
> Volker Tanger
> IT-Security Consulting
>=20
> - --
> discon gmbh
> Wrangelstra=DFe 100
> D-10997 Berlin
>=20
> fon +49 30 6104-3307
> fax +49 30 6104-3461
>=20
> volker.tanger@discon.de
> http://www.discon.de/
>=20
>=20
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6 (MingW32) - WinPT 0.5.5
>=20
> iD8DBQE+K7um0uordLlMxo4RAuP2AJwKDWUC0ruCMgr4lsmQMw rr2aZOXQCeOHdN
> LhhcvkURae1erxD3tN59SlQ=3D
> =3DarTl
> -----END PGP SIGNATURE-----
>=20
>=20
>=20