Subject: FWTK https connect security hole

From: "Larry Jackson" <[email-masked]>
Date: Thu, 20 Jan 2000 15:43:30 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Is there any way to patch the http-gw proxy's connect security hole?
I am aware of this hole from past messages, but I don't know how big of an
issue it is.

Could I just disable the connect command, or would this make something else
not work.

Is their a https-gw proxy that does not have the same problem?

Thanks,
Larry

---

From: Rick Murphy <[email-masked]>
Date: Thu, 20 Jan 2000 17:22:33 -0500

>I am aware of this hole from past messages, but I don't know how big of an

It's a big problem. If you use the http-gw for inbound access to your web 
server, anyone can connect to the HTTP port then issue a CONNECT verb to 
set up a telnet session to anywhere - including your inside network.

>Could I just disable the connect command, or would this make something else

Editing the code to remove the support is fairly easy. Remove all calls to 
'do_ssl' and 'do_shttp' in hmain.c. You're better off with plug-gw if 
you're going to do this - plug-gw can be set up with a fixed endpoint; with 
http-gw it's too easily exploited to permit unexpected inbound connections 
(ftp, gopher, etc..).

>Is their a https-gw proxy that does not have the same problem?
plug-gw has ssl CONNECT support.
         -Rick

---

From: "Larry Jackson" <[email-masked]>
Date: Thu, 20 Jan 2000 21:32:22 -0500

So this is only a problem if you accept inbound requests, Correct?
I'm not currently running any servers, so then its ok?

As far a patching http-gw goes, do you have to remove all the SSL support
or can you just intercept and reject any CONNECT calls?

Whats CONNECT used for anyway?
Would disabling it cause alot of web pages to stop working?

Larry

----- Original Message -----
From: Rick Murphy <[email-masked]>
To: Larry Jackson <[email-masked]>; FWTK List
<[email-masked]>
Sent: Thursday, January 20, 2000 5:22 PM
Subject: Re: FWTK https connect security hole

---

From: Rick Murphy <[email-masked]>
Date: Thu, 20 Jan 2000 21:40:21 -0500

>I'm not currently running any servers, so then its ok?

The CONNECT support lets your users configure the http-gw as a SSL proxy. 
It's not a security hole on it's own other than the fact that it can be 
used to connect anywhere. As long as your policy is that all internal users 
are permitted outbound, no problem. Some people were using http-gw to 
front-end an internal web server - permitting anyone, anywhere to connect. 
The ssl proxying support made that very risky.

>or can you just intercept and reject any CONNECT calls?

The only ssl support is in the do_ssl routine. It's a simple plug, 
effectively. The http-gw doesn't look at the SSL transaction in any way.

>Would disabling it cause alot of web pages to stop working?

CONNECT is how a web browser makes requests of an SSL-aware proxy. With 
CONNECT disabled, you can't proxy to secure web sites.
         -Rick

---

From: Keith Young <[email-masked]>
Date: Fri, 21 Jan 2000 10:29:29 -0500

> The ssl proxying support made that very risky.
	<snip>
> CONNECT disabled, you can't proxy to secure web sites.

Rick,

Thinking about this, isn't it possible to add support to restrict which
host (or at least which port) the CONNECT tries to go to? Ie., only
allow "CONNECT xxx.xxx.xxx.xxx:443"?

-- 
--Keith Young
-Director of Customer Care/Support, V-ONE Corp.
[email-masked]

---

From: Rick Murphy <[email-masked]>
Date: Fri, 21 Jan 2000 19:53:04 -0500

>allow "CONNECT xxx.xxx.xxx.xxx:443"?
Yes. Forcing it to use only the default port is pretty easy.
         -Rick