ISSalert: ISS Advisory: Multiple Buffer Overflow Vulnerabilities in Raytheon SilentRunner

TO UNSUBSCRIBE: email "unsubscribe alert" in the body of your message to
[email protected] Contact [email protected] for help with any problems!

-----BEGIN PGP SIGNED MESSAGE-----

Internet Security Systems Security Advisory
August 6, 2001

Multiple Buffer Overflow Vulnerabilities in Raytheon SilentRunner

Synopsis:

Internet Security Systems (ISS) X-Force in conjunction with ISS
Emergency Response Services (ERS) has discovered and researched remote
vulnerabilities in Raytheon SilentRunner. SilentRunner is a passive
network monitoring, discovery and analysis tool. The SilentRunner
collector module is the passive network monitoring component of the
program. The collector contains multiple buffer overflow
vulnerabilities that may be exploited by an attacker on networks
monitored by SilentRunner. Successful exploitation can result in a
Denial of Service (DoS) attack against the collector, or execution of
arbitrary code on the SilentRunner server.

Affected Versions:

Raytheon SilentRunner 2.0
Raytheon SilentRunner 2.0.1

It is unknown at this time if previous versions of SilentRunner are
affected by the vulnerabilities described in this advisory. ISS X-Force
recommends that SilentRunner customers contact Raytheon to determine if
previous versions are vulnerable.

Description:

SilentRunner is an advanced network analysis system built on top of a
passive network monitoring engine. The collector monitors and records
network traffic for use within other portions of SilentRunner.
SilentRunner can view network activity through its own collector, or
import network data from various other sources.

Multiple buffer overflow vulnerabilities exist in the collector
(cle.exe) component of SilentRunner. The routines that parse passwords
for many common protocols such as POP, HTTP, FTP, etc., do not perform
necessary bounds checking on user-supplied passwords. It is possible
for any user on any network monitored by a SilentRunner collector to
craft long strings that will crash the collector and possibly execute
arbitrary code on any system running the SilentRunner collector.

An additional buffer overflow vulnerability exists in the SilentRunner
"Knowledge Browser", a traffic analysis component of SilentRunner. The
Knowledge Browser does not perform adequate bounds checking on certain
long HTTP queries. Any user on a SilentRunner monitored network may
craft a long HTTP query, which will be recorded by the SilentRunner
collector. If the long HTTP query is processed by the Knowledge Browser,
malicious code may be executed on the SilentRunner server. Before the
Knowledge Browser can process traffic from the Silent Runner collector,
it must be manually started by a SilentRunner operator.

Recommendations:

Raytheon is aware of the vulnerabilities described in this advisory.

SilentRunner version 2.0 is vulnerable to all issues described in this
advisory. SilentRunner version 2.0.1 contains fixes for the long
password overflow vulnerabilities described above. SilentRunner 2.0.1
remains vulnerable to the long HTTP issue.

ISS X-Force will provide detection and assessment support for these
vulnerabilities in upcoming X-Press Updates for RealSecure Network
Sensor and Internet Scanner.

Additional Information:

The Common Vulnerabilities and Exposures (CVE) project has assigned the
Name CAN-2001-0636 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

Credits:

ISS X-Force would like to thank John Ventura of ISS ERS for discovering
this vulnerability.

About Internet Security Systems (ISS)
Internet Security Systems is a leading global provider of security
management solutions for the Internet, protecting digital assets and
ensuring safe and uninterrupted e-business. With its industry-leading
intrusion detection and vulnerability assessment, remote managed
security services, and strategic consulting and education offerings, ISS
is a trusted security provider to more than 8,000 customers worldwide
including 21 of the 25 largest U.S. commercial banks and the top 10 U.S.
telecommunications companies. Founded in 1994, ISS is headquartered in
Atlanta, GA, with additional offices throughout North America and
international operations in Asia, Australia, Europe, Latin America and
the Middle East. For more information, visit the Internet Security
Systems web site at www.iss.net or call 888-901-7477.

Copyright (c) 2001 Internet Security Systems, Inc.

Permission is hereby granted for the redistribution of this Alert
electronically. It is not to be edited in any way without express
consent of the X-Force. If you wish to reprint the whole or any part
of this Alert in any other medium excluding electronic medium, please
e-mail [email protected] for permission.

Disclaimer

The information within this paper may change without notice. Use of
this information constitutes acceptance for use in an AS IS condition.
There are NO warranties with regard to this information. In no event
shall the author be liable for any damages whatsoever arising out of or
in connection with the use or spread of this information. Any use of
this information is at the user's own risk.

X-Force PGP Key available at: http://xforce.iss.net/sensitive.php
as well as on MIT's PGP key server and PGP.com's key server.

Please send suggestions, updates, and comments to: X-Force
[email protected] of Internet Security Systems, Inc.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: noconv

iQCVAwUBO28HXzRfJiV99eG9AQHrPQQAn9NJmX1/26qbOGOStu9YEAdduNVwFG3A
5sjMoqhUFIKBRkpgKLqGdWsDUVYgo8Dk5MiMIR1tsWAH+0v9xlxdYxsEBXito40z
Hq7GjxI/0Tz+x/Wqedolw0som3ka+ibw9QxkCaxBX+crLH/pweFup8Dq5imcYwZ0
2limL+eObYQ=
=6AIi
-----END PGP SIGNATURE-----