Core Security Technologies Discovers Vulnerability in the IPv6 Protocol Stack of Open-Source Operating System.

Newly Detected Flaw in OpenBSD Enables Attackers to Gain Complete System Control Using Malformed IPv6 Traffic

BOSTON -- Core Security Technologies, provider of CORE IMPACT, the first-to-market penetration testing product for assessing specific information security risks, today issued an advisory disclosing a remote kernel buffer overflow vulnerability in the open-source operating system, OpenBSD. This vulnerability allows attackers to gain complete control of the target system, bypassing all the operating system's security mechanisms.

CoreLabs, the research arm of Core Security, discovered the critical flaw, which enables an attacker to exploit vulnerable systems by adding arbitrary code at the kernel level of the targeted operating system. This attack subverts any and all security mechanisms within the system.

OpenBSD is an open-source operating system that is recognized for its focus on security as a distinguishing feature. However, Core Security warns end users that even the most secure operating systems have vulnerabilities from time to time, including serious ones such as this latest discovery.

The vulnerability was discovered in the code of the operating system, which was developed to process Internet Protocol version 6 (IPv6) packets. This illustrates the possible perils in the implementation of relatively new and complex protocols, even in the most secure operating systems.

"For over a decade the OpenBSD team has done a superb job leading the way in the development of a very secure, free, general-purpose operating system," said Ivan Arce, CTO at Core Security Technologies. "However, 100% bullet-proof security is an unattainable goal and security-conscious users should be aware of that and remain prepared to quickly deploy fixes and workarounds should a serious problem like this surface."

Vulnerability Specifics

CoreLabs discovered that the OpenBSD kernel contains a memory corruption vulnerability in the code that handles IPv6 packets. Exploitation of this vulnerability can result in a complete system compromise when the remote execution of arbitrary code at the kernel level on the vulnerable systems is performed. Vulnerable systems may also be subject to remote denial of service attacks due to failed attempts to exploit the vulnerability, which can be triggered by sending a specially-crafted IPv6 fragmented packet. OpenBSD systems are vulnerable as the default kernel has IPv6 enabled and does not filter inbound IPv6 packets. The attack vector requires direct access or IPv6 connectivity to the local network.

The following operating system versions are confirmed to be vulnerable:

* OpenBSD 4.1, prior to February 26, 2006

* OpenBSD 4.0

* OpenBSD 3.9

* OpenBSD 3.8

* OpenBSD 3.6

* OpenBSD 3.1

All other versions of OpenBSD that support the IPv6 protocol stack are also believed to be vulnerable.

To address this vulnerability, users of OpenBSD should immediately apply the source code patch and recompile the kernel. Pre-compiled kernel binaries for OpenBSD 4.1, 4.0 and 3.9 are available at OpenBSD's website (www.openbsd.org). The patch is available at: ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/010_m_dup1.patch

Core Security advises that, as a work-around for users who cannot deploy the OpenBSD patch or those who do not need to process or route IPv6 traffic on their systems, all inbound IPv6 packets can be blocked by using OpenBSD's firewall.

For more information about this vulnerability and the systems affected, please visit: http://www.coresecurity.com/?action=item&id=1703

About CoreLabs

CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. Research is conducted in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing and cryptography. Results from these efforts include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies.

CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://www.coresecurity.com/corelabs/.

About Core Security Technologies

Core Security Technologies develops strategic solutions that help security-conscious organizations worldwide develop and maintain a proactive process for securing their networks. The company's flagship product, CORE IMPACT, is the first automated penetration testing product for assessing specific information security threats to an organization. Penetration testing evaluates overall network security and identifies what resources are exposed. It enables organizations to determine if current security investments are detecting and preventing attacks. Core augments its leading technology solution with world-class security consulting services, including penetration testing, software security auditing and related training. Based in Boston, MA and Buenos Aires, Argentina, Core Security Technologies can be reached at 617-399-6980 or on the Web at http://www.coresecurity.com.