OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: AI-SEC Security Advisories (advisories_at_ai-sec.dk)
Date: Mon Oct 14 2002 - 14:10:06 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Advanced IT-Security Advisory #02-10-2002

    http://www.ai-sec.dk/

    Issue:
    ======
    Symantec Enterprise Firewall Secure Webserver info leak

    Problemdescription:
    ===================
    There exists a problem in Simple, secure webserver 1.1 which is shipped with Raptor Firewall 6.5 (among others), in which an attacker can connect to the proxyserver from the outside, and issue a
    CONNECT to IP-addresses on the inside interface, and thereby determine if there are hosts present or not by inspecting the errormessage. This problem lets an attacker map out the entire topology of a
    client from the outside.

    Symantec has addressed this issue as a collateral problem in an earlier security update for the Symantec Enterprise Firewall. The Symantec Enterprise Firewall is not vulnerable to this concern if
    patched fully up-to-date.

    Versions affected:
    ==================
    Raptor Firewall 6.5 (Windows NT)
    Raptor Firewall V6.5.3 (Solaris)
    Symantec Enterprise Firewall 6.5.2 (Windows 2000 and NT)

    Solutions:
    ============
    Apply official patch from Symantec

    Patch:
    ======
    http://www.symantec.com/techsupp

    Vendorstatus:
    =============
    Symantec was contacted 27. August 2002. Symantec promptly tested and confirmed our findings. However, Symantec claims that this issue was fixed in a patch released late summer 2002.