Windows と Linux のセキュリティ: 噂の真相

Size: px

Start display at page:

Download "Windows と Linux のセキュリティ: 噂の真相"

としなりかがんじ
5 years ago
Views:

1 Windows Linux : Windows NT (JWNTUG) Event Planning Working Group

2 1: Linux Windows 2: Apache IIS 3: Netscape / Mozilla,, Opera IE 4: Microsoft fix

3 JWNTUG JWNTUG at your own risk

4 1: Linux Windows

5 (1) Eiji James Yoshida Open Port (TCP) ( ) [*] : OS Windows Linux Linux UNIX ( ) (/1111) [*]

6 (2) SecurityFocus.com 2002 Q1 TOP 10 attacks [*] 1. Code Red - MS Indexing Server/Indexing Services ISAPI Buffer Overflow Attack 2. Nimda - Microsoft IIS 4.0/5.0 Extended UNICODE Directory Traversal Attack 3. Matt Wright Formmail Attack 4. WU-FTPD File Globbing Heap Corruption Attack 5. SSH CRC32 Compenation Detection Attack 6. Generic CDE dtspcd Buffer Overflow Attack 7. Generic System V Derived Login Buffer Overflow Attack 8. Generic SNMP PROTOS Test Suite Attacks 9. Shaft DDoS Client To Handler Attack 10. PHP Post File Upload Buffer Overflow Attack [*] top10attacks_q1_2002.shtml

7 (3) fix OS / Microsoft RedHat Linux 7.2 Debian GNU/Linux Sun FreeBSD patch ! : patch (Sun)

8 : Linux OS security hole fix B "Trusted OS" security hole fix web web

9 : Open Source Closed Source Open Source Open Source Open Source fix and/or Use the source, Luke!

10 2: Apache IIS

11 IIS MS00-078/086/01 078/086/01-026: 026: UNICODE BUG MS01-023: 023: IPP ISAPI buffer overflow MS01-033: 033: Index server buffer overflow MS01-035: 035: FrontPage Server Extensions buffer overflow MS01-044: 044: cumulative patch (SSI buffer overflow ) MS02-018: 018: cumulative patch (ASP chunk encoding / HTTP header / SSI /.HTR buffer overflow, CSS ) MS02-028: 028: Heap overrun in HTR Chunked Encoding

12 Web JWNTUG IIS 7% 2% 34% 26% 18% Apache 22% 13% 14% 7% 12% IIS vs. apache

13 Apache bug free : fix : virtual hosting Host: CGI : Host:.log Apache hosting Win : Win32 Apache Remote command execution

14 Apache bug free ( ) 3 rd party PHP» PHP 4.htaccess. attribute transfer vuln.. (bid 2206)» PHP 4 engine disable source viewing vuln.. (bid 2205)» PHP post file upload buffer overflow (bid 4183) WebDAV» mod_encoding ( a, a) mod_ssl» buffer overflow (bid 4189) Apache tomcat» (bid 2982)

15 web application web SSI, CGI, ASP, JSP, PHP, ColdFusion, get cookie cookie (virtual?!)

16 Apache : IIS IIS Apache file/directory ISAPI IIS Lockdown, URLScan,, guard 3 patch IIS Apache IIS 6 (^^;;)

17 3: Netscape / Mozilla,, Opera IE

18 IE MS / 008 / 009 / 013 / 015 / 022 / 023 / 027» patch» MS MSN Java VM IE patch» HTML (MS02 MS fix )» gopher:// buffer overflow (bid 4930, MS02-027) 027)» ftp:// (bid 4954)» Unpatched IE security holes: jscript.dk/unpatched/

19 Netscape, Opera? IE Netscape / mozilla RC1 Opera 6.01 cookie / Opera 6.01, 6.02 Opera! fix Netscape

20 IE bug MIME Content-Type:» Content-Type: text/plain» fusianasan (.gif )» Opera» microsoft.com ( )

21 : Netscape, Opera = WWW IE Netscape / Opera IE? Opera Netscape IE 3rd party? web OS!! ( ( ) OS ( )

22 4: Microsoft fix

23 ftp:// (bid 4954) IE FTP Explorer web 2 ( ) ftp:// URL

24 ( ) OS PC98x1 48h IE fix OS 3 4?» MS (DebPloit( DebPloit NT/2000) 2.5» MS (Multiple UNC NT/2000/XP) 5.5

25 : LAC Content-Disposition Microsoft LAC lac.co..co.jp/security/intelligence/snsadvisory /48.html Microsoft 3 rd party software rt.asp Microsoft TechNet Security link MS fix

26 Microsoft web page ( ) mail ( )» ( )»?» CVE ( ( ) ; secure@microsoft microsoft.com ( )» 9:30-12:00, 13:00-19:00 19:00 MSKK 24h

27 Microsoft» ( ) OEM watch Microsoft»» Microsoft, OEM, 3 rd party Microsoft OEM? Software Update Services?

28 :! (by ) 1 fix? 1»» 1 Guninski ( )» 2 ( ) Sun

30 Microsoft Linux / Open Source djb?» djbdns, qmail, ( yp.to)»» Windows Windows Open Source!

31 CodeRed / Nimda patch»!» secure.net?»?!

32 Windows NT (JWNTUG) jwntug.or..or.jp/index-j.html : Mailing List Security ML JWNTUG Newsletter event Microsoft Conference (MSC) JWNTUG Open Talk» Microsoft BOF in Internet Week We need you!

33 Appendix

34 URL - Microsoft Microsoft Technet :» :» (HFNetChk, URLScan ):» Security Bulletin: MSxx-xxx xxx :» xxx.asp :» MSxx-xxx xxx

35 URL - Microsoft Microsoft (Knowledge Base) (Qxxxxxx):» microsoft.com/.com/technet/support/kb.asp?id=xxxxxx (JPxxxxxx, Jxxxxxx):» microsoft.com/.com/japan/support/kb/artivles/jpxxx/x/xx.htm» htm

36 URL web page US CERT/CC ( ( )» CERT/CC Incident Notes» CIAC ( ( )» ciac.org/ JPCERT/CC» jpcert.or..or.jp/ IPA» ipa.go..go.jp/security/

37 URL web page CVE» CAN-XXXX XXXX-XXX» bin/cvename.cgi?name=can- XXXX-XXX BUGTRAQ bugid XXXX» /XXXX Apache Week Apache httpd 1.3 vulnerabilities PHP» apacheweek.com/features/security.com/features/security-13» php.net/

38 URL web page RedHat Debian» jp.redhat.com/support/errata/» FreeBSD» freebsd.org/security/ Sun» cgi/secbulletin.pl

39 URL web page Netscape Security Center Opera» wp.netscape.com/.com/ja/security/» Georgi Guninski Security Research» guninski.com/

40 URL web page Windows NT (JWNTUG) port139» jwntug.or..or.jp/» jp/ Win» winsec.toranoana.ne.jp/ memo» st.ryukoku.ac..ac.jp/~kjm/security/antenna/ ZDNet Helpdesk Security How-To»

41 URL BUGTRAQ ( ( )» securityfocus.com/ NTBUGTRAQ ( ( )» ntbugtraq.com/ memo ML» Security Talk ML» 24 ML» port139 ML ( ( )» jp/ntsec_ml.htm

GTSC Security Response Team Microsoft Asia Limited ( ) 2

GTSC Security Response Team Microsoft Asia Limited ( ) 2 Agenda 3 No Yes or 4 OS etc HFNetChk Microsoft Baseline Security Analyzer (MBSA) 5 HFNetChk shavlik HFNetChk 6 HFNetChk HFNetChk XML DB XML DB http://download.microsoft