Bugtraq mailing list archives
AOL client port and possible security risk.
From: syousif () arn net (Sami A. Yousif)
Date: Fri, 24 Jan 1997 00:05:06 -0600
--Message-Boundary-12875 Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Content-description: Mail message body Note: I do not work for AOL. This information is the result of personal testing on my own side. It seems that AOL has changed the way that their client operates making previous firewall settings that allowed users behind a firewall to connect to AOL via TCPIP.. This information has been tested on the Windows95 version of the aol client 3.0 [the one with MSIE as the default browser]; and may affect other AOL clients. The short version: The new 3.0 AOL client sets up a VPN between the aol network and the local machine using port 5190 as the connection port. Long version: firewall admins who have users who use the aol client and have configured their firewalls to allow their users to connect to the AOL network via the TCPIP option of the AOL client may now have a concern on the way that the AOL client works. It seems that the AOL clients behavior has been changed from a simple client using a propriety protocol to a VPN client. When a user installs a new version of the AOL client on a Win 95 machine the AOL client creates a new network adapter in the win95 networking control panel "AOL Adapter". This adapter is analogous to the "Dialup Adapter" that windows 95 has, except that it is invoked only through the AOL client. When a user connects through the AOL client to the AOL network, it seems that the AOL client allows the AOL adapter to get an IP address that on the AOL network. This means that the local machine has an IP address that is on AOLs network which is tunneled through port 5190 to the local machine making any tcpip services that are available on the local machine vulnerable. [stuff like personal web servers, personal ftp servers and other items]{the effect is the same as a dialin account, but many users may not be aware of that}. To see this in action, use winipcfg when the aol client is installed, get the IP number that is given on the AOL adapter entry, and try and access it from a host outside. [ attached is the output of a route print command showing before and after routes on the local machine]. ---- -- Sami A. Yousif WT Box 1246 Canyon, TX 79016 Mailto:syousif () arn net Mailto:syousif () cyberjunkie com Talk:syousif () teddyr arn net Talk:syousif () mc119b wtamu edu Web:http://users.arn.net/~syousif Using the only viable internet provider in the Amarillo, TX area [http://www.arn.net/] Thought for the day: Dont do anything as root that you can do as a mortal. --Message-Boundary-12875 Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Content-description: Text from file 'rp.txt' Route before AOL client: Network Address Netmask Gateway Address Interface Metric 0.0.0.0 0.0.0.0 165.95.39.254 165.95.39.11 1 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1 165.95.39.0 255.255.255.0 165.95.39.11 165.95.39.11 1 165.95.39.11 255.255.255.255 127.0.0.1 127.0.0.1 1 165.95.255.255 255.255.255.255 165.95.39.11 165.95.39.11 1 224.0.0.0 224.0.0.0 165.95.39.11 165.95.39.11 1 255.255.255.255 255.255.255.255 165.95.39.11 0.0.0.0 1 Route after AOL client: Network Address Netmask Gateway Address Interface Metric 0.0.0.0 0.0.0.0 165.95.39.254 165.95.39.11 2 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1 152.163.192.0 255.255.224.0 152.173.125.247 152.173.125.247 1 152.163.231.0 255.255.255.0 152.173.125.247 152.173.125.247 1 152.163.232.0 255.255.248.0 152.173.125.247 152.173.125.247 1 152.168.0.0 255.248.0.0 152.173.125.247 152.173.125.247 1 152.173.125.247 255.255.255.255 127.0.0.1 127.0.0.1 1 165.95.39.0 255.255.255.0 165.95.39.11 165.95.39.11 2 165.95.39.11 255.255.255.255 127.0.0.1 127.0.0.1 1 165.95.255.255 255.255.255.255 165.95.39.11 165.95.39.11 1 224.0.0.0 224.0.0.0 152.173.125.247 152.173.125.247 1 224.0.0.0 224.0.0.0 165.95.39.11 165.95.39.11 1 255.255.255.255 255.255.255.255 152.173.125.247 0.0.0.0 1 --Message-Boundary-12875--
Current thread:
- NT RPC Hotfix Aleph One (Jan 23)
- Re: NT RPC Hotfix dsiebert () icaen uiowa edu (Jan 23)
- AOL client port and possible security risk. Sami A. Yousif (Jan 23)
- Re: NT RPC Hotfix Darren Reed (Jan 24)
- <Possible follow-ups>
- Re: NT RPC Hotfix Brad.Powell (Jan 24)
- Re: NT RPC Hotfix Yuri Volobuev (Jan 24)
- GNU tar vulnerability Ben Elliston (Jan 24)
- [NTSEC] NT vulnerable to DOS attack on more than just port 135 Bob Beck (Jan 25)