full-disclosure - Watchguard firewall appliances remote vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1033096947.11249.16.camel@harm>
From: tharbad at kaotik.org (Joao Gouveia)
Subject: Watchguard firewall appliances remote vulnerabilities

Scope: WatchGuard Firewall Appliances. 

Vendor: WatchGuard Technologies, Inc ( http://www.watchguard.com ). 

Affected: 
Vclass appliances running the current version of Vclass software. 
Legacy RSSA appliances running Vclass software. 
Legacy RSSA appliances that have not yet upgraded to Vclass software. 

Risk: Critical 

Timeline: 

Aug 22/2002 - First contact with Rapid Response Team. 
Sep 04/2002 - Sent a working exploit. 
Sep 12/2002 - Received a working Hotfix for RSSA 1000/6000. 
Sep 27/2002 - Public release. 

Description: Multiple remote input validation vulnerabilities in the 
command line interface that could be exploited to gain root level access
to the appliance. 

Details: 

The RapidStream login procedure works as follows: 

- Hacked openssh binary receives authentication parameters from client,
not doing any authentication, rather than confirming that the username
used is "rsadmin". 

- The password passed on the SSH login is sent as a parameter to the CLI
wrapper (/bin/cli) 

- The CLI wrapper passes the parameters to the CLI binary, wich proceeds
with the authentication, by launching "/bin/.cli -p <password>" 

Both issues relay on the fact that SSH doesn't do any type of real
authentication, wich allows any outside user to execute the CLI binary,
depending only that the username should be "rsadmin", wich is equivalent
to the 'root' user on this Linux based appliance. 

Issue 1: "Format Strings" vulnerability on the password parameter allows
an attacker to remotely compromise the firewall appliance. 

Issue 2: The CLI doesn't properly check for user input, wich could allow
an attacker to avoid beeing logged out after the authentication fails,
leaving the attacker in the CLI prompt with administrative priviledges. 

Rapid Response Team issued RS-302-HotFix-31 for 3.02 SP2 and Hotfix 2
for 3.2 SP1, wich should be available at
http://watchguard.com/vars/rssa.asp, along with information on this
issues. 

Acknowledgments: 

Steve Fallin <Steve.Fallin@...chguard.com> - For coordinating this
issues with the Rapid Response Team. 

Rodrigo Cunha <rnbc@...cabo.pt> - For reminding me of the obvious. 

Best regards, 

Joao Gouveia 
------------ 
tharbad@...tik.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20020927/b0a3ba81/attachment.bin