| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20110104221043.3462.qmail@securityfocus.com> Date: 4 Jan 2011 22:10:43 -0000 From: Jeromie@...secinc.com To: bugtraq@...urityfocus.com Subject: Plunging Through the Palo Alto Networks Firewall Class: Bypassing Intended Security Controls CVE: <NA> Remote: Yes Local: Yes Published: August 11, 2010 Timeline: Submission to MITRE: August 11, 2010 Credit: Jeromie Jackson CISSP, CISM COBIT & ITIL Certified President- San Diego Open Web Application Security Project (OWASP) Vice President- San Diego Information Audit & Control Association (ISACA) SANS Mentor LinkedIn: www.linkedin.com/in/securityassessment Blog: www.JeromieJackson.com Twitter: www.twitter.com/Security_Sifu Cell: 832-378-RISK (7475) Validated Vulnerable: All versions prior to 12/07/2010 Discussion: Palo Alto Networks firewall claims it can “identify and control applications regardless of port, protocol, encryption, or evasive tactic.” Due to the need for organizations to support protocols and applications not yet categorized by Palo Alto there is an underlying logic issue. Unless a company is willing to disable all services except for those well-known by the Palo Alto firewall risk will be constantly present. I spent a couple hours testing the Palo Alto Network firewall to see if I could puncture the firewall and achieve remote command-and-control. The Palo Alto Networks firewall uses “Application Visibility” and “Application Control” functions in order to identify services and apply controls across the firewall segments. An attacker can leverage a phishing scam or a vulnerabile online forum to distribute a remote command-and-control payload to a machine behind the firewall. The attacked machine will then initiate an outbound command-and-control connection. Palo Alto Networks Firewall simply identifies it as “Unknown TCP.” Exploit: First, I thought about using HTTP to traverse the firewall and remotely control a device behind the firewall. I successfully created a command-and-control session which the firewall identified as generic HTTP traffic. I leveraged the following script from The Hacker's Choice (THC): http://www.packetstormsecurity.org/groups/thc/rwwwshell-1.6.perl Second, I generated a Metasploit reverse_tcp command-and-control payload. I uploaded the payload to a website, generated a phishing email, and had the victim machine go to a malicious URL. Command-and-Control was achieved and the firewall simply characterized it as “Unknown TCP” traffic. Metasploit has the ability to encode the payloads in a plethora of ways- Palo Alto Networks will need to address all potential encodings in order to mitigate the risk. I worked with the vendor for several months and they recently came out with a signature update that will identify Metasploit. Due to evasion techniques such as encoding, payload packing, and other ways to evade filters I believe the signatures may not catch all payloads generated by Metasploit. I will be doing a little more work in the near future to run a small battery of tests to evaluate the detection rates. Below are the details pertaining to the update. I find it odd it was marked as a medium severity. Having these Metasploit remote command-and-control sessions enabled me to gain access to password hashes, install keyloggers, start remote desktop VNC sessions, hide my process, and to pivot off the attacked machine to gain further access into the environment. Vulnerability Signatures Summary Severity ID Attack Name CVE ID Vendor ID Default Action medium 33515 Metasploit Meterpreter Connection Attempt alert medium 33516 Metasploit Meterpreter Connection Attempt alert high 33616 IAX2 Asterisk Remote Denial of Service CVE-2007-3763 alert high 33446 Struts2 and XWork remote command execution Vulnerability CVE-2010-1870 alert critical 33605 Microsoft Office Memory Corruption Vulnerability CVE-2008-0118 MS08-016 alert high 33606 Microsoft Word Crafted SmartTag Record Code Execution Vulnerability CVE-2008-2244 MS08-042 alert critical 33607 Microsoft Excel Record Parsing Remote Code Execution Vulnerability CVE-2008-3006 MS08-043 alert critical 33608 Microsoft PowerPoint Picture Index Variant Remote Code Execution Vulnerability CVE-2008-0121 MS08-051 alert critical 33609 Microsoft PowerPoint List Value Parsing Remote Code Execution Vulnerability CVE-2008-1455 MS08-051 alert medium 33621 Oracle Web Cache Admin Module Denial of Service Vulnerability CVE-2002-0386 alert high 33627 Adobe Flash Player loadBitmap Memory Corruption Vulnerability cve-2010-3648 APSB10-26 alert Solution: A patch will be required from the vendor. In order for the vendor to meet its claims of “identifying and controlling applications regardless of port, protocol, encryption, or evasion techniques,” it will be required to gather signatures from at minimum the most prevalent command-and-control tools available in the wild and create identification techniques to mitigate the risk. Users could block all non-identified application traffic passing through the firewall to mitigate the risk, however this is generally not a viable option. While their technology is proving to be a strong firewall in the market the marketing statements are a bit lofty.
Powered by blists - more mailing lists