Specifications

PGP5i Automatic Key Generation Routine Vulnerability

Released May 24, 2000

Affects PGPi 5.0i

Reference http://www.securityfocus.com/bid/1251

Problem

- Vulnerability exists in the way PGP5i generates random keying material, when used without user

input. When a keypair is generated using: pgpk -g <DSS or RSA> <key-length> <user-id>

<timeout> <pass-phrase> pgp will automatically generate the key without any user intervention.

On systems which support /dev/random, it generates this key material by reading from this device

in 1 byte increments: RandBuf = read(fd, &RandBuf, count); which it then feeds in to its random

pool. Unfortunately, the above logic is flawed; read() returns the number of characters read.

- As count is always initialized to 1 in this case, RandBuf will always be assigned the value 1. This

makes it easy to predict keys. RSA keys generated this way are predictable; DSA/ElGamal

signature (DSA) keys are predictable, while encryption keys (ElGamal) vary.

SAFER

- Upgrade your PGPi 5.0i to PGPi 6.5.

NetOp Remote Control Unauthenticated File Transfer Vulnerability

Released May 23, 2000

Affects Data NetOp 6.50, 6.0

Reference http://www.securityfocus.com/bid/1263

Problem

- NetOp is a remote control utility, offering console access via network or serial connections. On NT

and Windows 2000 machines, the software runs in the SYSTEM context by default. The software

includes the ability to perform direct file transfers to and from the host machine.

- No authentication is required to perform this activity, meaning that any user with the freely

downloadable client and access to netbios sessions on the target can perform read/write/create

operations to any file on the system, including password and configuration data.

SAFER

- NetOp version 6.50 has the ability to use either NetOp or Windows security to authenticate users

immediately upon connection, although this is not enabled by default.

Cayman 3220H DSL Router "ping of death" Vulnerability

Released May 23, 2000

Affects Cayman 3220-H DSL Router 1.0, GatorSurf 5.5Build R1, R0, 5.3build R2, R1

Reference http://www.securityfocus.com/bid/1240

Problem

- Sending an oversized ICMP echo request to the router can cause a denial of service. Reported

effects vary; sometimes it stops telnet and http admin services, other times the router may restart

without routing but the admin services stay up.

SAFER

- Update has been released by the vendor.