bugtraq - Re: Arkeia Network Backup Client Remote Access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050222213855.29519.qmail@www.securityfocus.com>
Date: 22 Feb 2005 21:38:55 -0000
From: Arnaud Spicht <aspicht@...eia.com>
To: bugtraq@...urityfocus.com
Subject: Re: Arkeia Network Backup Client Remote Access


In-Reply-To: <20050222091943.GM76018@...CVA.da>

>On Sun, Feb 20, 2005 at 02:41:36PM -0600, H D Moore wrote:
>> Anyone able to connect to TCP port 617 can gain read/write access to the 
>> filesystem of any host running the Arkeia agent software. This appears to 
>> be an intentional design decision on the part of the Arkeia developers. A 
>> long-winded description of this issue, complete with screen shots, 
>> demonstration code, and packet captures can found online at:
>> 
>>  - http://metasploit.com/research/arkeia_agent/
>
>Note that, on the arkeia user list, somebody pointed out that clients
>can be configured to disallow this from anybody but the server. But that's
>not the default configuration, the default is "plug and play", that is, you
>throw the software on the client and it works.
>
>The relevant section is Appendix B of the user manual. It tells you how
>to setup your client with the equivalent of tcp_wrapper security.
>
>Even then, you still have a small vulnerability, in that anyone who
>has access to the server system can still impersonate the arkeia software
>to access the client. But you can't do that from any random machine.
>

>From Appendix B of Arkeia User Manual:
There is a way to tighten client access by requiring a connection on a reserved port and using root account. The format of the auth_PROCESS.cfg file to limit access is:
<PROCESS_NAME>.* ALLOW <backup server FQDN>[1] root

For example:
ARKADMIN.* ALLOW mercury.arkeia.com[1] root

-- 
Arnaud Spicht
CTO - Arkeia Corp.