Message-ID: <Pine.LNX.4.58.0406190951380.2030@roamer.defcon.org>
From: churley at assureddecisions.com (Chris Hurley)
Subject: Internet Scanner 7 Restriction Bypass Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application:            Internet Scanner 7
Vendors:                Internet Security Systems (www.iss.net)
Platforms:              Windows
Vulnerability:          Restriction Bypass
Severity:               Low-Allows Users to bypass license restrictions
Exploitation:           Editing .key file
Reported to Vendor:     20 April 04
Vulnerability Resolved: 16 June 04
Author:                 Chris Hurley, Assured Decisions LLC
e-mail:                 churley@...ureddecisions.com
URL:                    www.assureddecisions.com

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1) Introduction
2) Vulnerability
3) Resolution
4) Acknowledgments
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

===============
1) Introduction
===============

ISS Internet Scanner 7 is a commercial vulnerability scanning assessment
tool.

Internet Scanner 7 requires that a valid license key be installed on the
scanner console in order to initiate scans for IP addresses other than
localhost.  Legacy (Internet Scanner 6.2.1) users can cut a key using the
ISS web ordering system.  This key is then placed in the licenses folder.
When Internet Scanner 7 is started, it imports licenses from previous
versions and converts them to the appropriate .license format for use
with Scanner 7.

Due to changes in the software, legacy keys that are cut for a certain
range
are no longer restricted to just that range of IP addresses but can scan
any IP address.  In order to prevent this, a restricted license can be
generated.  A restricted key, when converted and registered as a .license
file also generates restrictions.  These restrictions are placed in the
licenses/restrictions folder and allow only the IP Addresses contained in
the restrictions file to be scanned.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

================
2) Vulnerability
================
An authorized Internet Scanner 7 user can modify the .key file to bypass
any restrictions associated with the key.
Key Contents:

The .key file is in the format:

- -----BEGIN ISSKEY5----
<hash>

- -----END ISSKEY5----


Customer:       Customer Name
Number:         Customer Number
Expires:        Expiration Date
Maintenance:    Maintenance agreement expiration date
Account:        Account Number
E-Mail:         contact email address

Created:        Date the Key was Created

Key Revision:   Revision number

Features:       ISS product key is valid with

                Allowable IP Addresses

Key Range Flag Legend:



If restrictions are placed on the key the legend is followed by:

- ----BEGIN ISSKEY6----

<?xml version=

<more restriction info>

<hash>

- -----END ISSKEY6----

A user can modify the original .key file and remove all information
starting with

- ----BEGIN ISSKEY6----

If the license has already been registered, it should be unregistered,
then the
new,
modified key placed in the licenses folder.  When the .license is
generated it is
then registered with no restrictions.

If the license has not been generated, the modified key is placed in the
licenses folder.
Internet Scanner 7 registers the license with no restrictions.

At this point Internet Scanner can be used to scan any IP Address
regardless of
the
restrictions placed on the key when it was cut.

- ----------------------------------------------------------------------------
If restrictions are placed on the key the legend is followed by:

- ----BEGIN ISSKEY6----

<?xml version=

<more restriction info>

<hash>

- -----END ISSKEY6----

A user can modify the original .key file and remove all information
starting with

- ----BEGIN ISSKEY6----

If the license has already been registered, it should be unregistered,
then the
new,
modified key placed in the licenses folder.  When the .license is
generated it is
then registered with no restrictions.

If the license has not been generated, the modified key is placed in the
licenses folder.
Internet Scanner 7 registers the license with no restrictions.

At this point Internet Scanner can be used to scan any IP Address
regardless of
the
restrictions placed on the key when it was cut.

- ----------------------------------------------------------------------------

Who is Vulnerable:
- -------------------------
Any Internet Scanner user that cuts restricted license keys for Scanner 7.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

===============
3) Resolution
===============
On 16 June 04, Internet Security Systems implemented the following fix to
resolve this vulnerability:

if "Enable Restriction" is checked AND the product code contains "NSB":

      only generate a K6 key

    otherwise

        generate the K5, K5/K6, or K6 key as usual.

===================
4) Acknowledgments
===================
Thanks to Abe Mounce, ISS Technical Support, for his dedication to seeing
this issue through to resolution.


Chris Hurley
Assured Decisions, LLC
410-290-6271
churley@...ureddecisions.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQFA1EV4+ahhAnkKnqoRAnFCAJ0WHnMzjomyAz5ygZ9ArzZ3dzZB4wCfVox4
0qdYHDnI7WBpMZUuVfG4UpU=
=OLu1
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists