BlackICE Agent Firewall Software May Fail to Perform Firewall Functions After Being in Standby Mode
|
|
SecurityTracker Alert ID: 1004478 |
|
SecurityTracker URL: http://securitytracker.com/id/1004478
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 6 2002
|
Impact:
Host/resource access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 3.1 eal
|
Description:
KPMG reported a vulnerability in the BlackICE Agent from Internet Security Systems. The product may fail to perform firewall functions after the host has returned from standby mode.
In the default configuration, a remote user could bypass the firewall functions if the protected host has been in standby mode.
According to the report, the BlackICE Agent parameter "restart.whenSuspend" is not always enabled by default. If it is not enabled, the firewall might not reactivate after a system standby. When this occurs, the software still appears to be working properly, as normal network communications are possible. However, the firewall is not filtering the network communications, so all network traffic is permitted.
|
Impact:
A remote user can bypass the firewall filtering functions.
|
Solution:
The vendor has released a fixed version (3.1 ebh), available at:
https://bvlive01.iss.net/issEn/DLC/login.jhtml
ISS assigned case number 526997 to this issue.
|
Vendor URL: www.iss.net/products_services/hsoffice_protection/ (Links to External Site)
|
Cause:
Access control error, State error
|
Underlying OS:
Windows (2000)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 6 Jun 2002 14:15:30 +0200
Subject: KPMG-2002019: BlackICE Agent not Firewalling After Standby
|
--------------------------------------------------------------------
Title: BlackICE Agent not Firewalling After Standby
BUG-ID: 2002019
Released: 06th Jun 2002
--------------------------------------------------------------------
Problem:
========
In a default installation, The BlackICE Agent might not reactivate
when the host returns from standby. This could allow a malicious
user to bypass the firewall completely.
Vulnerable:
===========
- BlackICE Agent 3.1 eal on Windows 2000 laptop
Not Vulnerable:
===============
- BlackICE Agent 3.1 ebh on Windows 2000 laptop
Details:
========
The BlackICE Agent setup contains the parameter
"restart.whenSuspend", which should be enabled by default. This,
however, is not always the case, and as a result the firewall
might not reactivate after a system standby. The BlackICE Agent
would still give all the appearences of being active, but the
filter function would not be in effect, and network communication
would be possible to the same extent as if the software wasn't
installed.
Vendor URL:
===========
You can visit the vendor webpage here: http://www.iss.net
Vendor response:
================
The vendor was notified on the 15th of March, 2002. The issue was
assigned case number 526997. On the 18th of March, we received a
workaround that seemingly solved the issue. On the 6th of June, 2002
the vendor informed us that the issue had been corrected in the
latest build.
Corrective action:
==================
Upgrade to BlackICE Agent V3.1 EBH, available through:
https://bvlive01.iss.net/issEn/DLC/login.jhtml
Author: Andreas Sandor (asandor@kpmg.dk)
--------------------------------------------------------------------
KPMG is not responsible for the misuse of the information we provide
through our security advisories. These advisories are a service to
the professional security community. In no event shall KPMG be lia-
ble for any consequences whatsoever arising out of or in connection
with the use or spread of this information.
--------------------------------------------------------------------
|
|
