Subject: http-gw exploit

From: "Jonathan B. Smith" <[email-masked]>
Date: Thu, 12 Oct 2000 10:37:36 -0000

This is a warning to all of you that are using http-gw packaged with the FWTK firewall.  I recently found that a hacker had gotten into my firewall and somehow used the http gateway to access the system.  The person(s) then changed the /etc/hosts.allow and /etc/hosts.deny files to allow access to themselves and deny access to all.  Please be aware of this.  It was a slip on my part to allow everyone access to the gateway.   If anyone else has the netperm-table allowing access to all, I strongly suggest that you change it.  

Jonathan B. Smith
Network Administrator
Aston Office
US² UNITED SUPPORT SYSTEMS
[email-masked]

---

From: Leandro Gelasi <[email-masked]>
Date: Thu, 12 Oct 2000 21:56:58 +0200 (CEST)

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

What do you mean with "open to all"?

How was your netpermtable configured?

Can you give us more details?

LG

*********************************************************************
Leandro Gelasi
V year Computer Science Engineering student at Siena University
[email-masked]

Gilles Villeneuve will live forever
*********************************************************************

---

From: Joseph S D Yao <[email-masked]>
Date: Thu, 12 Oct 2000 18:16:29 -0400

> US² UNITED SUPPORT SYSTEMS

As has been said many times, the http-gw is NOT DESIGNED to let people
into your network, and should never be used for that.

Nevertheless, they could NOT have gotten into your network the way you
describe unless you also have your Web server misconfigured to allow
some sort of Web server exploit, and probably your telnet gateway
configured to allow too easy access as well.

I hope that your Web server is not on the same machine as FWTK. There
should be NO other services on the FWTK machine, and no way through the
FWTK machine except for through the proxies.  Anything else is locking
the doors but leaving jagged holes in the sides of the house.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Keith Young <[email-masked]>
Date: Fri, 13 Oct 2000 10:24:42 -0400

Joseph S D Yao wrote:
> 
> On Thu, Oct 12, 2000 at 10:37:36AM -0000, Jonathan B. Smith wrote

Or, just allowed all access through http-gw.

Rick has talked about this many times, and this is in fact documented in
the FWTK FAQ:
	http://www.fwtk.org/fwtk/faq/faq.html#2.4.13

Also, have you upgraded your DNS server recently?

-- 
--Keith Young
-Director of Customer Care/Support, V-ONE Corp.
[email-masked]