Re: [ilugd] how secure is 802.11b??

2003-12-15 Thread Puneet
ask google for the best and precise info.

below is the stuff i wrote for my WLAN white papers some 7-8 months ago.
have a look
--
Adding a wireless network to an existing infrastructure offers several
advantages to an organization. For example, a wireless LAN user can save up
to eight hours per week compared with a wired LAN user, saving an
organization $260.50 per week on average (Source: WLANs: Improving
Productivity and Quality of Life,  Sage Research, Inc.). While many
organizations want to reap these benefits, they should first understand how
wireless networks could be vulnerable to several types of intrusion methods.
Perhaps the most common form of intrusion is eavesdropping, or the
unauthorized interception of wireless transmissions. Eavesdropping is
possible for two reasons:


  a.. Access Points use radio signals in the 2.4 Ghz range, a range
accessible to any computer with a wireless network interface card (NIC) or
frequency scanner.
  b.. 802.11b standard requires that wireless NICs operate in full
promiscuous mode, resulting in continual network broadcasts.

Wireless networks are also prone to denial-of-service attacks. A
denial-of-service attack occurs when an unauthorized mobile device transmits
so much information to an Access Point that the Access Point cannot
function. Any network is also open to rogue Access Points-unauthorized
Access Points that offer open-door access for wireless devices to the
network.



Because of these security concerns, many network managers have been
reluctant or unwilling to deploy WLANs, especially in light of the
vulnerability of the Wired Equivalent Privacy (WEP) keys that are used to
encrypt and decrypt transmitted data. Several research papers and articles
have highlighted the potential vulnerabilities of static WEP keys. In
addition, hackers have ready access to tools for cracking WEP keys, such as
AirSnort, which enables an attacker to passively monitor and analyze packets
of data and then use this information to break the WEP key that encrypts the
packets. Network managers need reassurance that WLANs can provide the same
level of security, manageability, and scalability offered by wired LANs.



Type of threats and attacks:

  Threat
 What it does
 Countermeasures

  Decoy access points
 Wireless LAN clients assume the decoy is a valid access point and
connect.
 Mutual authentication.

  Access point maps
 Web sites record precise location of any unsecured access points and
directions to it.
 Security architecture; smart deployment; authentication; encryption.

  Invisible access points
 Radios embedded in shipping, receiving and other systems create open
back door.
 Security policies; intrusion detection.

  Automated low-level attacks on WEP keys, passwords, addresses
 Programs run repeatedly to ferret out and crack an array of weaknesses.
 Intrusion detection; security architecture; access point configuration
management.


1.1 Traditional WLAN Security


As with other networks, security for WLANs focuses on access control and
privacy. Robust WLAN access control prevents unauthorized users from
communicating through APs, the WLAN endpoints on the Ethernet network that
link WLAN clients to the network. Strong WLAN access control ensures that
legitimate clients associate with trusted, rather than rogue APs. WLAN
privacy ensures that only the intended audience understands the transmitted
data. The privacy of transmitted WLAN data is protected only when that data
is encrypted with a key that can be used only by the intended recipient of
the data.



Traditional WLAN security includes the use of Service Set Identifiers
(SSIDs), open or shared-key authentication, static WEP keys and optional
Media Access Control (MAC) authentication. This combination offers a
rudimentary level of access control and privacy, but each element can be
compromised.



An SSID is a common network name for the devices in a WLAN subsystem; it
serves to logically segment that subsystem. An SSID prevents access by any
client device that does not have the SSID. By default, however, an AP
broadcasts its SSID in its beacon. Even if broadcasting of the SSID is
turned off, an intruder or hacker can detect the SSID through sniffing.



The 802.11 standard, supports two means of client authentication: open and
shared-key authentication. Open authentication involves little more than
supplying the correct SSID. With shared-key authentication, the AP sends the
client device a challenge text packet that the client must then encrypt with
the correct WEP key and return to the access point. If the client has the
wrong key or no key, authentication will fail and the client will not be
allowed to associate with the access point. Shared-key authentication is not
considered secure, because a hacker who detects both the clear-text
challenge and the same challenge 

[ilugd] Tee shirts

2003-12-15 Thread Sudev Barar
I am re-posting this as a new thread as the earlier posts got muddled
with upcoming meeting and tee shirt logo threads.
I have sanction from my company to purchase 50 T shirts. I need to know
the name to which the cheque should be made out. Urgently need this
information so that I can hand over the same at the meet to
treasurer???...
-- 
Sudev Barar

Learning Linux


___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


Re: [ilugd] Problem saving configuration!

2003-12-15 Thread Anuj Sharma


hi,

thats right narsingh, the command-line param  is myconf=scan (only when 
someone has made a persistent home)  myconfig=/mnt/hdaX' (x=1,2,3... 
depends) otherwise. but that doesnt seem to restore the complete settings. 
in particular the xvrefresh rate is not restored, nor is the desktop 
setting (including the wallpaper - which got me thinking about this).

regards
Anuj





From: Narsingh Sahu [EMAIL PROTECTED]
Reply-To: The Linux-Delhi mailing list [EMAIL PROTECTED]
To: The Linux-Delhi mailing list [EMAIL PROTECTED]
Subject: Re: [ilugd] Problem saving configuration!
Date: Sun, 14 Dec 2003 14:26:14 + (GMT)
 --- Basanta Pradhan [EMAIL PROTECTED] wrote:  Dear
Anuj,

 I was also having same problem. That's why I have
 installed Redhat 8.0 in my PC.

 One thing I want to say is that I am a daily readers
 of Linux For You. I am having several CD's with me.
 But I can suggest that Using Redhat 8.0 in 2 or 3 CD
 version is the best.

 If U want any assistance U can contact me in my
 E-mail address.

 Basanta Kumar Pradhan





 Anuj Sharma [EMAIL PROTECTED] wrote:
 hi all,

 as an experiment i am running my system with no
 operating system on it. i am
 using the LiFY CD for October to boot. i 'saved my
 preferred configuration'
  made a 'persistant home'. when i reboot as per the
 instructions on typing
 'linuxforu myconf=scan(or /dev/hda5 in my case)' the
 saved configuration
 should be loaded. however, while the 'config.tbz.
 file is found during boot
 the complete configuration is not restored. can
 anyone direct me as to what
 i may be doing wrong or not doing?
LiFY is actually based on Knoppix. As far as I
remember, Knoppix uses the cheatcode myconfig=scan
or floppyconfig or floppyconf in recent editions.
You can try these cheat codes. LiFY actually does not
tell you as to which edition it is based on, so may be
some hit and trial is required.
-- narsingh


Yahoo! India Mobile: Download the latest polyphonic ringtones.
Go to http://in.mobile.yahoo.com
___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd
_
Stand out from the crowd. Make your own MMS cards. http://msn.migasia.cn/msn 
Have some mobile masti!

___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


Re: [ilugd] solaris problem

2003-12-15 Thread yogesh anand
Hi,

We have a sun Sparc machine with solaris 9 installed.
we actually access it thru Hyper terminal from any
window pc.Is there any way to access the GUI of
solaris from another window machine.

With Regards


__
Do you Yahoo!?
New Yahoo! Photos - easier uploading and sharing.
http://photos.yahoo.com/

___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


[ilugd] Re: solaris problem

2003-12-15 Thread Jasmeet
cygwin + Xfree86

by hyper terminal, do u mean telnet ?
-js
yogesh anand wrote:
Hi,

We have a sun Sparc machine with solaris 9 installed.
we actually access it thru Hyper terminal from any
window pc.Is there any way to access the GUI of
solaris from another window machine.
With Regards

__
Do you Yahoo!?
New Yahoo! Photos - easier uploading and sharing.
http://photos.yahoo.com/


___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


Re: [ilugd] solaris problem

2003-12-15 Thread Vikram Gaur
Hi
Yogesh Search for Xmanager and hummingbird software.

Regards 
Vikram Gaur
- Original Message - 
From: yogesh anand [EMAIL PROTECTED]
To: The Linux-Delhi mailing list [EMAIL PROTECTED]
Sent: Monday, December 15, 2003 2:47 PM
Subject: Re: [ilugd] solaris problem


 Hi,
 
 We have a sun Sparc machine with solaris 9 installed.
 we actually access it thru Hyper terminal from any
 window pc.Is there any way to access the GUI of
 solaris from another window machine.
 
 With Regards
 
 
 __
 Do you Yahoo!?
 New Yahoo! Photos - easier uploading and sharing.
 http://photos.yahoo.com/
 
 ___
 ilugd mailing list
 [EMAIL PROTECTED]
 http://frodo.hserus.net/mailman/listinfo/ilugd



___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


Re: [ilugd] AutoCAD Drawing Viewer

2003-12-15 Thread LinuxLingam
yup! there are solutions!
[hehehehe]

(hint: openstandards fileformats with keywords.
opensource archive solution platform-agnostic.)

:-)
LL

On Mon, 2003-12-15 at 07:51, Anand Shankar wrote:
 For a large project, we have a large number of drawings in AutoCAD[snip]
 I am searching for a solution whereby all drawings can be catalogued in a
 Library Archive, [snip]
 Is there any Open Source solution?
 
 A related poblem: The drawings are typically in sections of 3m for large
 structures as high as 30m or more in A0 size paper. For a group discussion,
 [snip]inevitably a hard
 copy is required. Any technical solution for this??
 
 
 Anand Shankar




___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


[ilugd] Re: AutoCAD Drawing Viewer

2003-12-15 Thread Abhijit Menon-Sen
At 2003-12-15 16:32:24 +0530, [EMAIL PROTECTED] wrote:

 (hint: openstandards fileformats with keywords.
 opensource archive solution platform-agnostic.)

Do you actually know anything about the AutoCAD DXF file format, or are
you just trying to sound cool? (Hint: Google for DXF file format.)

And how does that solve the problem of looking at A0 drawings anyway?

-- ams

___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


[ilugd] [Fwd: New project: pcb for 8088/8086]

2003-12-15 Thread Nishikant Kapoor
 Original Message 
From: [EMAIL PROTECTED]
Title: pcb for 8088/8086
Description: this might not be directly related to linux..we are 
planning to build an 8088/86 based computer as part of our hardware 
project in delhi college of engineering.this particular processor was 
chosen because of its relative simpicity.

we have run into two problems..
1.we have found most of the component ICs..but the pcb is nowhere to be 
found..is there any place where we can get the pcb made or , where we 
can get it readymade?

2.BIOS- where the hell do we get the bios program?? i read once that 
linux can be used to substitue the bios...while that may not be possible 
in this case, is there any place where we can get the bios program for 
this particular setup??

the due date for submission is 9th jan, and we have very little 
time...any help would be greatly appreciated.
regards
Mayank Kaushik,3rd yr
Delhi College of Engg.
EC dept.



___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


RE: [ilugd] [Dglug] Remote Login To Linux Machine

2003-12-15 Thread Anuj Sharma
hi,

this one is really kewl. thnx.

anuj




From: kinshuk kulshreshtha [EMAIL PROTECTED]
Reply-To: The Linux-Delhi mailing list [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: [ilugd] [Dglug] Remote Login To Linux Machine
Date: Tue, 9 Dec 2003 02:41:12 -0800 (PST)
Hello Everyone
If you want to have a remote access to linux then you can do it very 
easily. There are many sites on the net which provides u shell accounts. 
http://cyberspace.org/ is  one such site. Just go to this site and register 
there to get a login name and password. Then telnet to cyberspace.org. Then 
you ll get a Login prompt just like u get when you boot a linux box. Enter 
proper login name and password and enjoy the heat of linux. You can also 
choose between various shells available at cyberspace like csh,bash,ksh 
etc. So...even if u dont ve  linux installed on ur system, u can practice n 
get the feel of it\
Regards
Kinshuk

-
Do you Yahoo!?
New Yahoo! Photos - easier uploading and sharing
___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd
_
R K Laxman fan? Get the best of his cartoons. 
http://server1.msn.co.in/sp03/gprs/howcani_cartoons.asp Now on your mobile.

___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


[ilugd] Is my machine being hacked?

2003-12-15 Thread Arjun Asthana
Hi,

   I am using RHL 7.2 with RP3 to connect to internet. While RP3 shows more 
than 1 kBp/s, the only app which in my knowlege is using internet is waiting 
for it's turn to use internet (or something like that). What should I do?
Thanks.

-- 
Arjun


___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


Re: [ilugd] how secure is 802.11b??

2003-12-15 Thread Virendra Rode
Hi Vivek,

You should examine the various device level standards supported by your 
vendor, such as WPA/802.11i and 802.1x. Also, you might want to consider 
IPSEC, PPTP, or another VPN solution. These would allow you to secure 
your own traffic from eavesdroppers, while still allowing open access 
(without using a separate AP for a secure channel).

regards,
Virendra
vivek khurana wrote:
HI! Everyone

 I want to know is 802.11b is really secure for
transmitting senestive data or should we relly on old
wired lan for transmitting sensetive data within an
organisation?? Also, which are the security technics
can be used with 802.11b.
with regards
vivek
 

=
When DESTINY has closed all the DOORS;
Jump out of the WINDOW
__
Do you Yahoo!?
New Yahoo! Photos - easier uploading and sharing.
http://photos.yahoo.com/
___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


[ilugd] [Dglug] Electrical Engineers?

2003-12-15 Thread Virendra Rode
Hi there,

Are there any electrical engineers in the house? If so, please contact 
me directly at [EMAIL PROTECTED] for further details.



regards,
Virendra
___
Dglug mailing list
[EMAIL PROTECTED]
http://lists.asiaosc.org/mailman/listinfo/dglug
___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


[ilugd] [Dglug] Injection Molding Anyone?

2003-12-15 Thread Virendra Rode
Hi there,

Just wondering if anyone knows or can connect me to the right people who 
are into injection molding? I would like to build an outer shell (case) 
for a hardware box (see mechanical dimension below).

Board Dimensions 180 mm x 150 mm
High from top side 15 mm for RJ45 connectors
High from bottom side 10 mm for PCMCIA ( 5 mm stand off )
Currently looking at 100 pieces a year. Please contact me directly and 
we can talk details.



regards,
Virendra
___
Dglug mailing list
[EMAIL PROTECTED]
http://lists.asiaosc.org/mailman/listinfo/dglug
___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


Re: [ilugd] [Dglug] Electrical Engineers?

2003-12-15 Thread Raj Mathur
 Virendra == Virendra Rode [EMAIL PROTECTED] writes:

Virendra Hi there, Are there any electrical engineers in the
Virendra house? If so, please contact me directly at
Virendra [EMAIL PROTECTED] for further details.

Once again, why?

Virendra regards, Virendra

-- 
Raj Mathur[EMAIL PROTECTED]  http://kandalaya.org/
   GPG: 78D4 FC67 367F 40E2 0DD5  0FEF C968 D0EF CC68 D17F
  It is the mind that moves

___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


Re: [ilugd] Re: Is my machine being hacked?

2003-12-15 Thread Tarun Dua
On Mon, 2003-12-15 at 21:12, Sandip Bhattacharya wrote:
 Arjun Asthana wrote:
  Hi,
  
 I am using RHL 7.2 with RP3 to connect to internet. While RP3 shows more 
  than 1 kBp/s, the only app which in my knowlege is using internet is waiting 
  for it's turn to use internet (or something like that). What should I do?
 
 Use tcpdump on ppp0 interface to see any traffic if present. If TCP/UDP 
 based traffic, check the local port number and then use netstat with the 
 -p parameter to find the process which is using the socket.
More: Download the latest version of chkrootkit and run it after a 
#make sense
Enable your firewall, that will prevent any crack from communicating
home or launching DDOS from your machine.
-Tarun
-- 
http://www.tarundua.net
Nothing you ever wanted to find about Tarun Dua


___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


[ilugd] file permission problem

2003-12-15 Thread MALKIAT BENIPAL
Dear all,
 
While I was working in linux (Mandrake 9.0) suddenly there was a power fluctuation due 
to loose connection of cables between my PC and my UPS sockets. With the result the PC 
rebooted. Now when I login in my user and use vi editor to open a new file or save an 
existing file after working with it and when I try to save the same, I get the error 
message as 'can not open the existing file for writing' thereby I am unable to save my 
file. Even if I try to save this file with another name eg. ' : wq! malkiat ' I get 
the same error message. Please help me how I can set the file permission of my 
respective users to their earlier state. Please guide and I shall be verymuch thankful 
to you.
 
Best Regards,
 
Malkiat
 


MALKIAT
 
[EMAIL PROTECTED] 



-
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


Fwd: [ilugd] file permission problem

2003-12-15 Thread MALKIAT BENIPAL


MALKIAT BENIPAL [EMAIL PROTECTED] wrote:Date: Mon, 15 Dec 2003 21:36:53 -0800 (PST)
From: MALKIAT BENIPAL 
To: [EMAIL PROTECTED]
Subject: [ilugd] file permission problem

Dear all,

While I was working in linux (Mandrake 9.0) suddenly there was a power fluctuation due 
to loose connection of cables between my PC and my UPS sockets. With the result the PC 
rebooted. Now when I login in my user and use vi editor to open a new file or save an 
existing file after working with it and when I try to save the same, I get the error 
message as 'can not open the existing file for writing' thereby I am unable to save my 
file. Even if I try to save this file with another name eg. ' : wq! malkiat ' I get 
the same error message. Please help me how I can set the file permission of my 
respective users to their earlier state. Please guide and I shall be verymuch thankful 
to you.

Best Regards,

Malkiat



MALKIAT

[EMAIL PROTECTED] 



-
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


MALKIAT
 
[EMAIL PROTECTED] 



-
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


Re: [LAP] Re: [ilugd] [FSF India Board] CBSE syllabus]

2003-12-15 Thread Ankit Jain
Hi,
I can help out in getting in touch with Mukesh sir. There have been some
new developments also in the same regard.. I have been in touch with
mukesh sir regularly.

-Ankit

Dhruv Gami said:

 There have  been some earlier  efforts about the  CBSE. I do  not know
 what the details. So,  I am making a post to the  -friends. Let us see
 what comes out.

 Will you please be kind enough to  post me (on or off list) details of
 that?? Even  contacts of people who  put in the efforts  / pointers to
 list archives will help.

 I  remember that people  from the  Delhi LUG  had done  something, But
 cannot exactly remember it.

 Hi,

 I happened to be present at one of the meetings that CBSE held in DPS RK
 Puram in June 2002 alongwith Mr. Mukesh (AFAIR, HOD of CS Department
 there), Prateek Khanna and Ankit Jain (both from ILUGD).

 The original mail I posted on the list does not seem to have been
 archived, but Raj's reply to that (which contains most of the original
 mail) can be found at
 (http://www.mail-archive.com/[EMAIL PROTECTED]/msg0.html)

 At that time, CBSE was interested in experimenting with including Linux
 into their curriculum, and wanted our feedback on the same. During the
 meeting, Prateek, Ankit and I drafted a syllabus based on their existing
 one, and made it platform independant. This syllabus was for a
 vocational course that CBSE runs in about 35 schools across the country,
 and was not to be included in the mainstream courses, at least for the
 time being.

 At the time, we convinced the CBSE officials to include a Linux based
 operating system as an alternative to windows, and to leave it upto the
 school to decide which OS to use as the primary OS for instruction. The
 syllabus included a clause stating that the teachers should teach the
 concepts using one platform, and demonstrate the same on the other
 platform in one or two lectures.

 There was one thing that bothered the CBSE officials though...and that
 was support for the schools which will be installing linux and
 demonstrating it. At the time, LAP(Linux Access Project) was initiated,
 and we had hoped to have a project which would be able to provide CBSE
 just that, but somehow things didn't work out. Supreet Sethi, Pankaj
 Kaushal and Sandeep Rathi from Sarai worked hard and came out with a
 customised linux distribution meant specifically for schools. Sadly, the
 project has gone into hibernation since then.

 LAP has been inactive for a while, mainly because of lack of resources,
 but if something is being stirred again, I'm confident we can revive
 this project, and return with renewed energy.
 (http://lap.linux-delhi.org)

 As for the task at hand, I believe the best person to contact would be
 Mr. Mukesh in DPS RK Puram. He's a part of the CBSE syllabus drafting
 committee, and is very interested in getting linux included into the
 CBSE syllabus.

 If there's any other way in which we at ilug-d can help, let us know on
 the main mailing list, or on [EMAIL PROTECTED], the LAP mailing
 list.

 Hope this helped. Comments, and more details from those who remember them
 are welcome.

 regards,
 Gami




-- 
Debugging is twice as hard as writing the code in the first place.
Therefore, if you write the code as cleverly as possible, you are,
by definition, not smart enough to debug it. - Brian W. Kernighan

___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


Re: [ilugd] [Dglug] Electrical Engineers?

2003-12-15 Thread Raj Mathur
 Virendra == Virendra Rode [EMAIL PROTECTED] writes:

Virendra Hi there, Are there any electrical engineers in the
Virendra house? If so, please contact me directly at
Virendra [EMAIL PROTECTED] for further details.

Once again, why?

Virendra regards, Virendra

-- 
Raj Mathur[EMAIL PROTECTED]  http://kandalaya.org/
   GPG: 78D4 FC67 367F 40E2 0DD5  0FEF C968 D0EF CC68 D17F
  It is the mind that moves
___
Dglug mailing list
[EMAIL PROTECTED]
http://lists.asiaosc.org/mailman/listinfo/dglug


___
ilugd mailing list
[EMAIL PROTECTED]
http://frodo.hserus.net/mailman/listinfo/ilugd


[ilugd] (fwd) Cyrus IMSP remote root vulnerability

2003-12-15 Thread Raj Mathur
[Please upgrade if you use Cyrus-IMSP -- Raju]

This is an RFC 1153 digest.
(1 message)
--

Message-ID: [EMAIL PROTECTED]
From: Felix Lindner [EMAIL PROTECTED]
Sender: [EMAIL PROTECTED]
To: [EMAIL PROTECTED], [EMAIL PROTECTED]
Subject: [Full-Disclosure] Cyrus IMSP remote root vulnerability
Date: Mon, 15 Dec 2003 19:55:53 +0100



n.runs GmbH
http://www.nruns.com/ [EMAIL PROTECTED]
n.runs-SA-2003.001   15-Dec-2003


Vendor:Andrew Systems Group, Carnegie Mellon (cmu.edu)
Product:   Cyrus IMSP
Vulnerability: Buffer overflow in address book handling
Affected Releases: 1.4, 1.5a6, 1.6a3, 1.7
NOT Affected Releases: -
Severty:   HIGH
CERT tracking: VU#933878
CVE:   n/a


Vendor communication:
  08.12.2003   Initial notification
  08.12.2003   Rob Siemborski answers
  08.12.2003   Rob Siemborski sends a patch
  09.12.2003   n.runs tests the patch and finds it to be correct
  09.12.2003   CERT VU# assigned
  12.12.2003   Rob Siemborski sends the new versions
  15.12.2003   public release


Overview:
  Cyrus IMSP is a implementation of the IMSP protocol [2]. 

  The Internet Message Support Protocol (IMSP) is designed to support
  the provision of mail in a medium to large scale operation. It is
  intended to be used as a companion to the IMAP4 protocol [IMAP4], 
  providing services which are either outside the scope of mail access 
  or which pertain to environments which must run more than one IMAP4
  server in the same mail domain. The services that IMSP provides are 
  extended mailbox management, configuration options, and address
  books.

  There is a remotely exploitable buffer overflow in the Cyrus IMSPd. 
  The vulnerability can be triggered before authentication. The IMSP 
  daemon is required to run as root.

Description:
  In the function abook_dbname, a sprintf() call takes place. The 
  function takes two char pointers (dbname and name), which are later 
  used in the sprintf() call:
  
  sprintf(dbname, abookdb, ownerlen, name, name);

  abookdb is defined as 
  
  static char abookdb[] = user/%.*s/abook.%s;

  Several functions in the code use abook_dbname() and supply a local 
  char buffer of 256 bytes as first argument to the function. Since the 
  second argument name is controlled by the user in serveral protocol 
  messages [2], a remotely exploitable buffer overflow is created.

Example:
  n.runs has a prove of concept exploit for the issue discussed.

Solution:
  Andrew Systems Group has released new versions. Older versions are
  no longer supported.

  ftp://ftp.andrew.cmu.edu/pub/cyrus/cyrus-imspd-v1.6a4.tar.gz
  ftp://ftp.andrew.cmu.edu/pub/cyrus/cyrus-imspd-v1.7a.tar.gz
  and
  http://ftp.andrew.cmu.edu/pub/cyrus/cyrus-imspd-v1.6a4.tar.gz
  http://ftp.andrew.cmu.edu/pub/cyrus/cyrus-imspd-v1.7a.tar.gz
  


Credit: 
  Bug found by Felix Lindner and Michael Guenther of n.runs GmbH. 
  Additional credits to Steffen Weinreich for support during research.

  Greets to Halvar, Johnny Cyberpunk, Nicolas Fischbach, [EMAIL PROTECTED]


References:

  [1] http://asg.web.cmu.edu/cyrus/download/
  [2] http://asg.web.cmu.edu/cyrus/rfc/imsp.html


The information provided is released by n.runs as is without warranty
of any kind. n.runs disclaims all warranties, either express or implied,
expect for the warranties of merchantability. In no event shall n.runs
be
liable for any damages whatsever including direct, indirect, incidental,
consequential, loss of business profits or special damages, even if
n.runs has been advised of the possibility of such damages.
Distribution or reproduction of the information is provided that the 
advisory is not modified in any way.

Copyright 2003 n.runs. All rights reserved.


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

--

End of this Digest
**

-- 
Raj Mathur[EMAIL PROTECTED]  http://kandalaya.org/
   GPG: 78D4 FC67 367F 40E2 0DD5  0FEF C968 D0EF CC68 D17F
  It is the mind that moves