From provos@citi.umich.edu Thu Jan 22 02:02:57 2004 From: Niels Provos To: bugtraq@securityfocus.com Date: Wed, 21 Jan 2004 03:50:50 -0500 Subject: Honeyd Security Advisory 2004-001: Remote Detection Via Simple Probe Packet -----BEGIN PGP SIGNED MESSAGE----- Honeyd Security Advisory 2004-001 ================================= Topic: Remote Detection Via Simple Probe Packet Version: All versions prior to Honeyd 0.8 Severity: Identification of Honeyd installations allows an adversary to launch attacks specifically against Honeyd. No remote root exploit is currently known. Details: ========= Honeyd is a virtual honeypot daemon that can simulate virtual hosts on unallocated IP addresses. A bug in handling NMAP fingerprints caused Honeyd to reply to TCP packets with both the SYN and RST flags set. Watching for replies, it is possible to detect IP addresses simulated by Honeyd. Although there are no public exploits known for Honeyd, the detection of Honeyd IP addresses may in some cases be undesirable. Solutions: ========== A new version of Honeyd has been released to address this issue. The source code for Honeyd 0.8 can downloaded from http://www.citi.umich.edu/u/provos/honeyd/ In addition, Honeyd 0.8 drops privileges if permitted by the configuration file and contains command line flags to force dropping of privileges. Nontheless, it is suggested to run Honeyd in a chroot environment under a sandbox like Systrace. Thanks To ========= Anonymous for information about the detection problem. More Information: ================= More information on Honeyd can be found at http://www.honeyd.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (OpenBSD) iQEVAwUBQA49IzZ8FqYKL4flAQHbQQf+IvfxPWaXz2tPjfhN8oOkp4JhOdcGcfOw AN8BVgvZxw9+AAv+r6kuuyIZMmJQwp4CfiYqh4b0A8Wq7pWb08g1GGQnnvAmnzgU yjEJE0H1qm6cd3xftsGA5j+leWM/IfW+BWRPSwBtDqxSRzPGD+Tnkt43zqUE8f5i +Owg9YDH2rFoomU0xzD5LHjaBDL89Ef8iU6YvRaVI2tix+GeINGUDkW20EtT1727 szP+y8XzsdaU3o+ZkqQ2s0uvJZyr0zzhenhuy9VGM9bvXq7NlcwUWyoJdQU6bZCl rVZKc8mAjX6gRYLbSf0E5yE9HIxxOdXt9q9U1wRIXoOizn9V2Loanw== =X/C4 -----END PGP SIGNATURE-----