Vulnerability

    RealSecure

Affected

    RealSecure 3.2.x

Description

    The Modulo  Security Labs  Team found  during a  test program  two
    ways to stop the ISS RealSecure  3.2.x engine.  The engine is  the
    responsible for  the duty  of checking  and logging  packets.  The
    exploit is very  simple to be  reproduced and protection  measures
    must be adopted.

    Tested systems:

        3.2.1 Solaris - Vulnerable
        3.2.2 Solaris - Vulnerable
        3.2.1 WinNT - Vulnerable

    A failure  in the  treatment of  fragmented packets  with the  SYN
    flag  setted  causes  the  immediate  failure  in  the  RealSecure
    engine, disabling the intrusion detection.

    On  the  Solaris  version   of  RealSecure  the  engine   proccess
    ('network_engine') is  disabled, causing  a core  dump memory file
    creation.   The   event  is  immediately   reported  through   the
    RealSecure console.

    On the NT version, the engine service file  ('network_engine.exe')
    has a  little different  bug.   The service,  after being crashed,
    restarts  immediately,  generating  just  a Windows NT Application
    Log event.  The tests showed  that a big and continuous stream  of
    the these packets  (SYN Flood) can  take the processor  load up to
    100%.  During this attack, RealSecure could not identify any other
    type of attack.

    The  tests  showed  that  the  Solaris  version have an additional
    vulnerability on  the SYN  packets treatment.   With a  SYN  Flood
    attack with  specific IP  flags setted  it is  possible to disable
    the engine in the same way  as described above.  A 50  packets per
    minute attack was enough  to cause the flaw  in a simulation.   On
    both versions (NT  and Solaris) the  console could not  report the
    fragmented attack.   The NT  version can  identify the  fragmented
    SYN attack as a simple SYN Flood.

    A detailed  version of  this advisory  will be  issued as soon ISS
    fix the product.

Solution

    The tests with  the Solaris version  indicates that disabling  the
    SynFlood   and   IPFRAG   attacks   detection   can   avoid    the
    'network_engine' process failure.