Subject: Re: (usr-tc) HiperARC - Dangerous HiperBomb

From: Jamie Orzechowski <[email-masked]>
Date: Sat, 14 Aug 1999 03:59:04 +0000

I have blocked telnet access to the Class C which my arcs site on as a
temporary fix ...

----- Original Message -----
From: Ed Taylor <[email-masked]>
To: <[email-masked]>
Sent: Friday, August 13, 1999 7:50 PM
Subject: (usr-tc) HiperARC - Dangerous HiperBomb

> For HiperBomb code check out:
>
> http://www.securityfocus.com/templates/archive.pike?list=1
>
> It is very serious and reboots the HiperArc's from anywhere.
>
>
> Ed
>
>
> ---------- Original Message ----------------------------------
> From: "Jamie Orzechowski" <[email-masked]>
> Reply-To: [email-masked]
> Date:     Fri, 13 Aug 1999 19:03:36 -0400
>
> >Just reading my Securityfocus email list and attacked was a new "Remote
> HiPER ARC nuking program"
>
> I have the source if anyone cares to have it ...
>
> ----- Original Message -----
> From: Jonathan Chapman <[email-masked]>
> To: <[email-masked]>
> Sent: Thursday, August 12, 1999 6:10 PM
> Subject: 3com hiperarch flaw [hiperbomb.c]
>
>
> > Hello,
> >
> > The attached program will reboot a 3com HiperARC.  I made an attempt to
> > contact 3com before posting this report, however, I received no
response.
> > By flooding the telnet port of a 3com HiperARC using the provided
program,
> > the HiperARC unconditionally reboots.  This program is effective over
all
> > interfaces, including a dialup.
> >
> > Regards,
> >
> > Jonathan Chapman
> > Director of Network Security
> > FIRST Incorporated
> > [email-masked]  www.1st.net
>
>
>
> -
>  To unsubscribe to usr-tc, send an email to "[email-masked]"
>  with "unsubscribe usr-tc" in the body of the message.
>  For information on digests or retrieving files and old messages send
>  "help" to the same address.  Do not use quotes in your message.
>
>
> -
>  To unsubscribe to usr-tc, send an email to "[email-masked]"
>  with "unsubscribe usr-tc" in the body of the message.
>  For information on digests or retrieving files and old messages send
>  "help" to the same address.  Do not use quotes in your message.
>
>

-
 To unsubscribe to usr-tc, send an email to "[email-masked]"
 with "unsubscribe usr-tc" in the body of the message.
 For information on digests or retrieving files and old messages send
 "help" to the same address.  Do not use quotes in your message.

---

From: Jeff Mcadams <[email-masked]>
Date: Sat, 14 Aug 1999 04:04:31 +0000

Thus spake Jamie Orzechowski
>I have blocked telnet access to the Class C which my arcs site on as a

Another possible fix (I assume...haven't tested for sure) would be to
disable the telnet service....that has the obvious side affect of making
them unavailable to network management via the CLI though...If you can
get by with SNMP management, that could work...just remember my previous
notice about elevated SNMP access if you have multiple access levels
defined on the Arc's SNMP agent.  Best bet I guess would be to relay
SNMP requests via the NMC...slows things down, but is the securest
method at this point I 'spect.
-- 
Jeff McAdams                            Email: [email-masked]
Head Network Administrator              Voice: (502) 966-3848
IgLou Internet Services                        (800) 436-4456

-

---

From: Rick <[email-masked]>
Date: Sat, 14 Aug 1999 05:14:44 +0000

I can confirm this security-bug EXISTS. I compiled the source of hyper-nuke and
did indeed reboot some of my arcs (4.1.59-6).

As others have stated I would suggest implementing accesslists on your routers
that deny all telnet (tcp-25) traffic to your arcs.

Ed Taylor wrote:

> > contact 3com before posting this report, however, I received no response.
> > By flooding the telnet port of a 3com HiperARC using the provided program,
> > the HiperARC unconditionally reboots.  This program is effective over all

--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Rick Allan / [email-masked] | Connect to a Backbone not a Wishbone
Head of Network Engineering    |    Monmouth Internet Corporation
732-842-5366=====extension 102 |      http://www.monmouth.com
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

-

---

From: Rick <[email-masked]>
Date: Sat, 14 Aug 1999 05:23:02 +0000

typo in my last message. It should read "deny all telnet traffic (tcp-23)"

-

---

From: Marshall Morgan <[email-masked]>
Date: Sat, 14 Aug 1999 08:10:40 +0000

But your own customers can still reboot them via dialup to that NAS.

Marshall Morgan

Internet Doorway, Inc. (aka NETDOOR)

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Rick
> Sent: Friday, August 13, 1999 10:07 PM
> To: [email-masked]
> Subject: Re: (usr-tc) HiperARC - Dangerous HiperBomb
> 
> 

-

---

From: Ed <[email-masked]>
Date: Sat, 14 Aug 1999 08:46:47 +0000

There is a solution to that... but no true fix (outside of disabling Telnet)
until 3com fixes the code in the ARCs. It probably wouldn't hurt to also
make the code a little more robust and fix V90 too.

Ed

----- Original Message -----
From: Marshall Morgan <[email-masked]>
To: <[email-masked]>
Sent: Saturday, August 14, 1999 2:09 AM
Subject: RE: (usr-tc) HiperARC - Dangerous HiperBomb

Marshall Morgan

-

-

---

From: [email-masked]
Date: Sat, 14 Aug 1999 15:25:16 +0000

Is there a way to deny access to the port, but allow only certain
IPS to telnet to it?

==============================================================================
Phillip Ferraro				WorldNet Access, Inc
[email-masked]	Onslow County's PREMIER InterNet Service 
Voice (910) 346-0835		    824 Gumbranch Square, Suite R3
FAX   (910) 455-1933		     Jacksonville, Nc  28540-6269
==============================================================================

-

---

From: Jeff Mcadams <[email-masked]>
Date: Sat, 14 Aug 1999 15:55:40 +0000

Thus spake [email-masked]
>	Is there a way to deny access to the port, but allow only certain

I *think* this would work...would need to be an input filter of
course...I *think* input filters filter data for packets destined for
the system itself.  I know IOS on cisco's doesn't do this, but I think
the HiPer Arcs do.  Keep in mind that to be sure, you'd also have to put
this filter on all your dialup interfaces as well...

I'll try to check this out in more depth today when I go to the office.
-- 
Jeff McAdams                            Email: [email-masked]
Head Network Administrator              Voice: (502) 966-3848
IgLou Internet Services                        (800) 436-4456

-

---

From: Peter <[email-masked]>
Date: Sat, 14 Aug 1999 16:11:42 +0000

Jeff Mcadams <[email-masked]> wrote
 
> this filter on all your dialup interfaces as well...
 
	cisco does, you can apply an ACL to the vty's.

	eg:

access-list 199 permit ip 10.216.0.0 0.0.0.255 any log-input
access-list 199 deny ip any any log-input

line vty 0 4
  access-group 199 in

	now, does anyone know if the anti-spoof filters in hiper
	syslog? ^^; (I dont manage them myself)

	P
	----*

-- 
My words, my mail, my meaning.

-

---

From: Jeff Mcadams <[email-masked]>
Date: Sat, 14 Aug 1999 16:32:33 +0000

Thus spake Peter

>	cisco does, you can apply an ACL to the vty's.

Well...true...but an ACL on the regular interface doesn't do it...which
was what I was implying...sorry about the non-clarity.  :)
-- 
Jeff McAdams                            Email: [email-masked]
Head Network Administrator              Voice: (502) 966-3848
IgLou Internet Services                        (800) 436-4456

-

---

From: Tatai SV Krishnan <[email-masked]>
Date: Sat, 14 Aug 1999 19:53:24 +0000

The workaround for this problem is setting up telnet clients on the hiper 
arc  and enabling telnet client access.  This program all it does is 
tries to open tcp connections, so on the hiper arc do this

add telnet client <ip address of single host or subnet that you want to 
allow access to the hiper arc via telnet>

enable telnet cli

This will tell the hiper arc to have access only from trusted hosts and 
this program will not cause any crash if some one tries to use it from 
different hosts.  

This hower is a work around only - We do understand that this is a 
serious issue and would come up with a fix.

regards

krish

-----------------------------------------
		\	T.S.V. Krishnan  \
		 \      Network System Engineer \ ( : - : )
		  \     3Com ............   \
		----------------------------------------------/
[email-masked]  
----------------------------/ http://interproc.ae.usr.com ----/
-------------------------------------------------------------------------\
	Any Sufficiently advanced bug is indistinguishable for a feature.
						- Rick Kulawiec
-------------------------------------------------------------------------/

-

---

From: Jeff Mcadams <[email-masked]>
Date: Sat, 14 Aug 1999 20:02:24 +0000

Thus spake Tatai SV Krishnan

>enable telnet cli

wow...learn something new every day.
-- 
Jeff McAdams                            Email: [email-masked]
Head Network Administrator              Voice: (502) 966-3848
IgLou Internet Services                        (800) 436-4456

-

---

From: "Brian M. Gordon" <[email-masked]>
Date: Sun, 15 Aug 1999 00:36:01 +0000

How would I add a range of ips?

----- Original Message -----
From: Tatai SV Krishnan <[email-masked]>
To: Marshall Morgan <[email-masked]>
Cc: <[email-masked]>
Sent: Saturday, August 14, 1999 1:39 AM
Subject: RE: (usr-tc) HiperARC - Dangerous HiperBomb

-

---

From: Jamie Orzechowski <[email-masked]>
Date: Sun, 15 Aug 1999 03:33:21 +0000

I did a disable telnet client_access but I can still telnet in after I do
this???

----- Original Message -----
From: Jeff Mcadams <[email-masked]>
To: <[email-masked]>
Sent: Saturday, August 14, 1999 2:00 PM
Subject: Re: (usr-tc) HiperARC - Dangerous HiperBomb

-

---

From: "Brian M. Gordon" <[email-masked]>
Date: Sun, 15 Aug 1999 04:22:34 +0000

enable not disable.

----- Original Message -----
From: Jamie Orzechowski <[email-masked]>
To: <[email-masked]>
Sent: Saturday, August 14, 1999 9:28 PM
Subject: Re: (usr-tc) HiperARC - Dangerous HiperBomb

-

---

From: Jeff Mcadams <[email-masked]>
Date: Sun, 15 Aug 1999 05:25:16 +0000

>I did a disable telnet client_access but I can still telnet in after I do

You need to enable it, not disable.  this is basically the setting that
tells the telnet service to check the client access table to check to
see if that system is allowed to check...if you disable this setting, it
doesn't check the table and assumes everyone is allowed to connect.
-- 
Jeff McAdams                            Email: [email-masked]
Head Network Administrator              Voice: (502) 966-3848
IgLou Internet Services                        (800) 436-4456

-

---

From: Tatai SV Krishnan <[email-masked]>
Date: Sun, 15 Aug 1999 16:50:08 +0000

> How would I add a range of ips?
Individual hosts 

add telnet client <ip address>
...
...

A subnet of address

add telnet client ip address netmask
add telnet client 10.10.0.0/24 

...
..
etc

krish

-

---

From: Tatai SV Krishnan <[email-masked]>
Date: Sun, 15 Aug 1999 16:53:09 +0000

Here is the steps.

Add the telnet client <ip>
then 
enable telnet client_access

if you disable the same you will be able to telnet into the hiper arc.

krish

-

---

From: Kevin Benton <[email-masked]>
Date: Mon, 16 Aug 1999 16:30:31 +0000

> serious issue and would come up with a fix.

This is a bit more than slightly irritating.  I just got back from
vacation and found this message here and saw that the WeeklyService Update
did not include any field service reports or any warnings about the fact
that this *known* bug has been found.  As far as I'm concerned, this
should have been posted on CERT.

Kevin Benton
SOTA Technologies

-

---

From: Jeff Mcadams <[email-masked]>
Date: Mon, 16 Aug 1999 16:33:44 +0000

Thus spake Kevin Benton
>should have been posted on CERT.

Heh...who's to say that it won't be....with CERT's blisteringly fast
response time </sarcasm> they may come out with an alert 6 weeks from
now.
-- 
Jeff McAdams                            Email: [email-masked]
Head Network Administrator              Voice: (502) 966-3848
IgLou Internet Services                        (800) 436-4456

-