Conducting Security Assessments Dan Elder Security Engineer Novacoast Eron Howard Manager Development Services Novacoast

© March 22, 2004 Novell Inc. 2 Novacoast, Inc. Company Facts Founded in 1996 Based in Santa Barbara, California Named Novell “Partner of the Year” for 2002 Professional Services company with practice areas that have been built around key engineers who specialize in a given technology Offices in California, Utah, Arizona, Texas and Oregon National resource for Novell Consulting Receiving our fourth Novell Service Excellence Award

© March 22, 2004 Novell Inc. 3 Introduction Published Vulnerabilities for Exchange and Groupwise Auto execution of code Site redirection Hex obfuscation Attacks on Antivirus systems Novacoast security assessments Credits and sources

© March 22, 2004 Novell Inc. 4 Published Vulnerabilities in Groupwise : Novell Groupwise Webaccess Cross Site Scripting Vulnerability : Novell GroupWise Wireless Webaccess Insecure Logged Password Vulnerability : Novell GroupWise WebAccess Information Disclosure Vulnerability : Novell Groupwise Mail Transport Agent Unspecified Denial Of Service Vulnerability : Novell GroupWise WebAccess Unspecified Malicious Script Vulnerability : Novell GroupWise Internet Agent Buffer Overflow Vulnerability : Novell GroupWise Web Root Disclosure Vulnerability : Novell GroupWise 6 Post Office LDAP Authentication Bypass Vulnerability : Novell Groupwise Servlet Gateway Default Authentication Vulnerability : Novell Groupwise Arbitrary File Retrieval Vulnerability : Novell GroupWise Padlock Vulnerability : Novell Groupwise Directory Disclosure Vulnerability : Novell GroupWise Network Directory Browsing Vulnerability : Novell GroupWise GWWEB.EXE Multiple Vulnerabilities

© March 22, 2004 Novell Inc. 5 Published Vulnerabilities in Exchange Exchange :Microsoft Outlook Web Access HTML Attachment Script Execution Vulnerability :Microsoft Exchange Server 5.5 Outlook Web Access Cross-Site Scripting Vulnerability :Microsoft Exchange Server Buffer Overflow Vulnerability :Microsoft Exchange Server SMTP HELO Argument Buffer Overflow Vulnerability :Microsoft Exchange Server 5.5 IMAP NOOP Denial of Service Vulnerability :Microsoft Exchange Server IMC EHLO Response Buffer Overflow Vulnerability :Microsoft IIS SMTP Service Encapsulated SMTP Address Vulnerability :Microsoft Remote Procedure Call Service DoS Vulnerability :Microsoft Outlook Web Access with RSA SecurID Authentication Bypass Vulnerability :Microsoft Windows SMTP Service Authorization Bypass Vulnerability :Microsoft OWA Server Embedded Script Execution Vulnerability :Microsoft Exchange OWA Global Address List Disclosure Vulnerability :Microsoft Outlook Web Access Denial of Service Vulnerability :Microsoft Exchange 5.5 LDAP Denial of Service Vulnerabilities :Microsoft Exchange OWA Embedded Script Execution Vulnerability :Microsoft Exchange Server Invalid MIME Header charset = "" DoS Vulnerability Outlook :Microsoft Outlook / Exchange Blank Headers DoS Vulnerability :NT Exchange Server Encapsulated SMTP Address Vulnerability :Multiple Vendor PKCS#1 Vulnerability :Microsoft Exchange Server AUTH / XAUTH / AUTHINFO DoS Vulnerabilities :Microsoft Exchange Server Empty MIME Boundary DoS :Multiple Browser URI Display Obfuscation Weakness :Microsoft mshtml.dll Library GIF Image Handling Denial of Service Vulnerability :Multiple Outlook/Outlook Express Predictable File Location Weaknesses :Microsoft Internet Explorer Double-Null URI Denial Of Service Vulnerability :Microsoft Outlook Mailto Parameter Quoting Zone Bypass Vulnerability :Multiple Outlook/Outlook Express Predictable File Location Weaknesses :Microsoft Internet Explorer Double-Null URI Denial Of Service Vulnerability :Microsoft Internet Explorer Absolute Position Block Denial Of Service Vulnerability :Microsoft mshtml.dll Library GIF Image Handling Denial of Service Vulnerability :Microsoft Outlook 2002 V1 Exchange Server Security Certificate Information Leakage Vulnerability :Microsoft Outlook Header Processing Denial of Service Vulnerability :Microsoft Outlook HTML Mail Script Execution Vulnerability :Microsoft VBScript ActiveX Word Object Denial Of Service Vulnerability :Microsoft Outlook Disabled Cookies Setting Bypass Vulnerability :Microsoft Outlook IFrame Embedded Media Player File Vulnerability :Microsoft Outlook Javascript Execution Vulnerability :Microsoft Outlook IFrame Embedded URL Vulnerability :Microsoft Outlook Arbitrary Code Execution Vulnerability :Microsoft Outlook Unauthorized Access Vulnerability :Multiple Outlook/Outlook Express Predictable File Location Weaknesses :Microsoft mshtml.dll Library GIF Image Handling Denial of Service Vulnerability :Microsoft Outlook and Outlook Express Arbitrary Program Execution Vulnerability :Multiple Vendor Client JavaScript Information Leakage Vulnerability :Microsoft Outlook HTML Mail Script Execution Vulnerability :Microsoft VBScript ActiveX Word Object Denial Of Service Vulnerability :Microsoft Outlook Disabled Cookies Setting Bypass Vulnerability :Microsoft Outlook Javascript Execution Vulnerability :Microsoft Outlook IFrame Embedded URL Vulnerability :Microsoft Outlook Arbitrary Code Execution Vulnerability :Microsoft MSHTML.DLL Crash Vulnerability :Microsoft Outlook Unauthorized Access Vulnerability :Microsoft Outlook Express Address Book Spoofing Vulnerability :Microsoft Outlook vcard Buffer Overflow Vulnerability :Microsoft Outlook Vcard DoS Vulnerability :Microsoft Outlook Concealed Attachment Vulnerability :Microsoft Outlook Rich Text Format Information Disclosure Vulnerability :Microsoft Outlook / Outlook Express Cache Bypass Vulnerability :Microsoft Outlook / Outlook Express GMT Field Buffer Overflow Vulnerability : Microsoft Internet Explorer and Outlook/Outlook Express Remote File Write Vulnerability : Microsoft Office 2000 UA Control Vulnerability : Microsoft Signed ActiveX Active Setup Vulnerability : Microsoft ActiveX CAB File Execution Vulnerability

© March 22, 2004 Novell Inc. 6 Autoexecution of code 1 st Demo Can code be executed without opening an message?

© March 22, 2004 Novell Inc. 7 Site Redirection 2 nd Demo Can a user be sent to a website that appears to be a legitimate and have improperly signed code run on the users machine that appears to be legitimate? Can this code run a program on the local workstation and send an to all users on the system?

© March 22, 2004 Novell Inc. 8 Hex Obfuscation/Hacking with Google 3 rd Demo Can critical information about users and companies be found using Google? Can an message be crafted to trick a user into executing code that looks legitimate?

© March 22, 2004 Novell Inc. 9 Attacks on AntiVirus Systems 4 th Demo Can executed code un-install Antivirus Software and infect a network

© March 22, 2004 Novell Inc. 10 Novacoast Security Assessments Who is Novacoast? What do we do?

© March 22, 2004 Novell Inc. 11 Credits and Sources Security Focus Astalavista.net DoxPara Research JohnnyIHackStuff Novacoast Security Group

© March 22, 2004 Novell Inc. 13 General Disclaimer This document is not to be construed as a promise by any participating company to develop, deliver, or market a product. Novell, Inc., makes no representations or warranties with respect to the contents of this document, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to revise this document and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. All Novell marks referenced in this presentation are trademarks or registered trademarks of Novell, Inc. in the United States and other countries. All third-party trademarks are the property of their respective owners. No part of this work may be practiced, performed, copied, distributed, revised, modified, translated, abridged, condensed, expanded, collected, or adapted without the prior written consent of Novell, Inc. Any use or exploitation of this work without authorization could subject the perpetrator to criminal and civil liability.