Every day, intruders break into Web sites. How do they do it? There are dozens of ways. In most cases, someone failed to establish adequate security controls, and an intruder was able penetrate the network. Now, that may seem obvious, but malicious users can use methods to subvert a normally functioning system without actually penetrating that system's security. As a matter of fact, attacks take many forms.
In a recent edition of the Windows 2000 Magazine "Security Update," there were no fewer than six different security risks identified in third party products. These risks included:
■ A Denial of Service condition in Netopia's Timbuktu Pro software. By performing a specific series of connections and disconnections, an intruder can cause the authentication protocol to misbehave, thereby causing the software to hang.
■ SNMP Trap Watcher Denial of Service. By sending a trap string of more than 306 characters to the SNMP Trap Watcher 1.16 monitoring system, an intruder can crash the software.
■ True North Software's Internet Anywhere 3.1.3 mail server had two problems reported. By sending a specific string of characters as the parameter of the RETR POP3 command, an intruder can crash the server. In addition, if an intruder opens 3,000 or more connections on the SMTP port, the server will respond with an error reporting too many connects. By establishing a second large set of connections (800 or more) immediately after the 3,000 connections, the intruder can crash the service.
■ Checkpoint Technologies' Firewall-1 software could be tricked by an intruder using particular techniques. Once tricked, the firewall will open TCP ports to an FTP server behind the firewall.
■ MYSQL Server had a vulnerability reported that allows a remote user to bypass password checking. The problem is a result of faulty string checking.
■ Novell's GroupWise Web Access was vulnerable to a specific URL being sent to the interface. By sending the URL, a malicious user can crash the server.
In each of the cases listed, the company was aware of the problem and had either issued the patch or was working on the patch.
This is one week's worth of issues, reported by just one publication. There are more that go unreported, or reported in a different forum. If your digital nervous system is going to be hooked to the Internet, your organization will be vulnerable to these kinds of attacks. During this stage of the process, it is important to know what type of risk prevention your company is willing to fund.
Was this article helpful?