Very Computer

I thought I'd ask if anyone is familiar with any security problems with
the US Robotics Netserver line of terminal servers or their
implementation of RADIUS.  I haven't come across anything so far (good or
bad), as the product is somewhat new.  I'd appreciate any coments.

Truly,

Vik

: I thought I'd ask if anyone is familiar with any security problems with
: the US Robotics Netserver line of terminal servers or their
: implementation of RADIUS.  I haven't come across anything so far (good or
: bad), as the product is somewhat new.  I'd appreciate any coments.
:
: Truly,
:
: Vik

US Robotics Netservers are virtually identical to Livingston Portmaster
communications servers running ComOS 3.1.4 (later revisions aren't being
licensed to US Robotics anymore). They are quite popular with many ISPs and
I haven't heard about any security problems relating to ComOS or their
implementation of Radius ever.

dave

--
David-Michael Lincke
Research Assistant
Institute for Information Management IWI-HSG, University of St. Gallen

URL:    http://www-iwi.unisg.ch/about/team/dal.html

--
,..............................................,
|               Lance Cavener                  |


`----------------------------------------------'
|  "The Apple Macintosh is for people who get  |
|   confused with more than 1 mouse button"    |
|               Former lead programmer of OS/2 |
`----------------------------------------------'

Quote:>licensed to US Robotics anymore). They are quite popular with many ISPs and
>I haven't heard about any security problems relating to ComOS or their
>implementation of Radius ever.

The RADIUS server, as distributed by Livingston, has serious
bounds-checking problems. The server runs with root creds, meaning that as
soon as someone releases a slick DNS-overflow exploit for Linux or
FreeBSD, it'll be modified within a day to a "get root quick through
radiusd" exploit.

On top of that, the "shared secrets" between the terminal servers and the
authentication server are stored in cleartext.

Finally, within the last quarter, there was a row about a ComOS
denial-of-service problem which allowed arbitrary people to crash their
Portmaster products.

-----------------------------------------------------------------------------
Tom Ptacek at The rdist Organization / exit(main(kfp->kargc, argv, environ));

"If you're so special, why aren't you dead?"

 Then explain how to fix all thoes exploits.

--
,..............................................,
|               Lance Cavener                  |


`----------------------------------------------'
|  "The Apple Macintosh is for people who get  |
|   confused with more than 1 mouse button"    |
|               Former lead programmer of OS/2 |
`----------------------------------------------'