-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2009.0079                  AUSCERT Advisory

                                [Appliance]
      Ingate Firewall and Ingate SIParator: Administrator Compromise
                               3 April 2009
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              Ingate Firewall
                      Ingate SIParator
Operating System:     Network Appliance
Impact:               Administrator Compromise
                      Denial of Service
                      Provide Misleading Information
                      Reduced Security
Access:               Remote/Unauthenticated
CVE Names:            CVE-2008-0960 CVE-2008-5077
Member content until: Friday, May 01 2009

Ref:                  AL-2008.0073
                      AL-2008.0135
                      ESB-2008.0593
                      ESB-2008.0594
                      ESB-2008.0622
                      ESB-2008.0797
                      ESB-2008.1014
                      ESB-2008.1031
                      ESB-2009.0009
                      ESB-2009.0020
                      ESB-2009.0038
                      ESB-2009.0110
                      ESB-2009.0195
                      ESB-2009.0307
                      ESB-2009.0310

OVERVIEW:

       A number of vulnerabilities have been identified in Ingate Firewall
       prior to version 4.7.1 and Ingate SIParator prior to version 4.7.1.


IMPACT:

       Ingate has released the following information regarding these 
       vulnerabilities:

       "When an IPsec tunnel having the remote network set to 'Remote/private 
       address' is allowed to configure the unit, and that tunnel comes up, 
       the entire world can configure the unit.[Tracking IDs: 4091, 4127]" [1]

       "IDS/IPS no longer cause SIP packets to bypass logging and IPsec spoof 
       protection and blacklisting. [Tracking ID: 3706]" [1]

       "Server certificates with DSA and ECDSA keys are now properly checked.
       CVE: CVE-2008-5077. [Tracking ID: 4119]" [1]

       "SNMPv3 now properly validates the HMAC of the authentication.
       Previously, it was possible to bypass the authentication.
       CERT: VU#878044. CVE: CVE-2008-0960.  [Tracking ID: 3854]" [1]

       "If multiple default gateways are used, and the policy for packets
       from unused gateways is set to 'reject', the spoofing protection
       may not work.  Other problems with the rules may also be present.
       After the upgrade, it is no longer possible to set this policy to
       'reject'.  [Tracking ID: 3943]" [1]

       Multiple denial of service vulnerabilities in the SIP module, which
       can be exploited via specially created packets have also been 
       reported. [1]


MITIGATION:

       To address these vulnerabilities Ingate has released updates to these
       products which are available from the vendor's website. [2]


REFERENCES:

       [1] Release notice for Ingate Firewall 471 and Ingate SIParator 471 
           http://www.ingate.com/Relnote.php?ver=471

       [2] Ingate: Download Upgrades
           http://www.ingate.com/upgrades.php

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFJ1WHnNVH5XJJInbgRAoNPAKCGaLB6XTAMnUXZXIMOikSX7Ud/cACfUQ7a
6VnM4YB+2eOBdwp8Q+HRQKM=
=Qt4z
-----END PGP SIGNATURE-----