[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[FYI] Censonrware turns Firewall into an open door


Security Hole found in NAI Firewall

Censorware gaffe turns "World's Most Secure Firewall" into an open door. 
By Kevin Poulsen
May 22, 2000 7:48 AM PT

A firewall package protecting thousands of networks worldwide contains a bug that would allow attackers to obtain "root" access remotely, potentially compromising the very networks the program was installed to protect, SecurityFocus News has learned. 

The vulnerability is in the Unix distribution of Network Associates Inc.'s (NAI) Gauntlet firewall suite, billed by the company as the "World's Most Secure Firewall." Jim Stickley, a San Diego-based computer security consultant with Garrison Technologies, discovered the bug while performing a security audit for a corporate client in Seattle, and reported it to NAI late Friday night. A team of a dozen company engineers scrambled to produce a fix over the weekend, which the company was preparing to distribute to customers Monday morning.

The hole is the result of two flaws in Network Associate's integration of Mattel's Cyber Patrol filtering software into their feature-packed firewall product. In integrating Cyber Patrol, NAI programmers created a custom server that checks web address against the Cyber Patrol database, then approves or disapproves each connection going out through the firewall depending on whether it's permitted by a particular company's policy.

That server contains a buffer overflow bug, and, further, mistakenly accepts connections from the outside world, Network Associates V.P. of Engineering Tom Ashoff confirmed Sunday.


Kristian Köhntopp, NetUSE Kommunikationstechnologie GmbH
Siemenswall, D-24107 Kiel, Germany, +49 431 386 436 00
Using PHP3? See our web development library at
http://phplib.netuse.de/ (We have moved! Update your bookmarks!)