[NT] Method Found to Bypass ATGuard's Firewall

From: support@securiteam.com
Date: 04/30/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Tue, 30 Apr 2002 21:49:10 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Method Found to Bypass ATGuard's Firewall
------------------------------------------------------------------------

SUMMARY

ATGuard is a very good personal desktop Firewall that comes with a wide
range of functionality. A security vulnerability in the product allows
attackers to install programs that will pose as legitimate allowed to
connect to initiate connections to the Internet programs.

DETAILS

Vulnerable systems:
 * ATGuard Personal Firewall version 3.2

It is possible to allow for specific applications specific connections.
For example, most users use Internet Explorer to browse the internet. It
is a logical assumption, that people using the Internet Explorer to browse
the WWW allow outbound connections to all hosts at least to the
destination TCP port 80. Unfortunately, ATGuard does not save the file
paths nor does it use checksums, to determine whether the executed program
is real the one (that should be allowed to connect to all hosts on TCP
port 80), but rather it just uses the filename (in this case
"IEXPLORE.EXE").

Impact:
ATGuard can be fooled to think that a disallowed program is allowed to
connect to the internet. Trojan horses which use outbound connections or
using < http://www.http-tunnel.com/HT_Products_HTTPTunnelClient.asp>
HTTP-Tunneling-Software to tunnel unwanted connections (like ICQ) are not
blocked.

Vendor response:
The vendor no longer exists, Norton the new owner of the company, has been
contacted.

ADDITIONAL INFORMATION

The information has been provided by
<mailto:BlueScreen@IT-Checkpoint.net> BlueScreen.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • Re: What is the Pattern here ?
    ... These are all Dialup Connections that I had no connection with at the time. ... It's obviously an enormous security hole, ... > and a real firewall box. ...
    (comp.security.firewalls)
  • Re: Securing against an internet based intrusion
    ... negotiated network handshaking connections. ... Can I assume from reading the above links that the default security ... attacker guesses the right password? ... you mentioned guessing via the internet to be slow.....with ...
    (microsoft.public.windowsxp.security_admin)
  • Re: 0x800C0005, 0x81000370, computer admin file missing
    ... Blank Page When You Try to Access Windows Update ... " Security or Internet acceleration software, such as AtGuard by WRQ ...
    (microsoft.public.windowsupdate)
  • [NT] eServ Memory Leak Enables Denial of Service Attacks
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... the server allocates a block of memory on the heap ... to leak. ... An attacker who can repeatedly establish connections with the eServ daemon ...
    (Securiteam)
  • Re: outbound filtering
    ... If he really knew a lot about security he would be willing ... Well, that will tell you where your remote endpoint connections are and what programs are making the connection, but not much more than that. ... For a real time display of remote connections I'd recommend Kerio Personal Firewall, or if the OP doesn't want a firewall, than sysinternals.com TCPMon. ... inter-process communication, some feature that you wouldn't like to miss ...
    (comp.security.firewalls)