Honeyd Security Advisory 2004-001: Remote Detection Via Simple Probe Packet

[Niels Provos <provos () citi umich edu>]

-----BEGIN PGP SIGNED MESSAGE-----

Honeyd Security Advisory 2004-001
=================================

Topic:    Remote Detection Via Simple Probe Packet

Version:  All versions prior to Honeyd 0.8

Severity: Identification of Honeyd installations allows an
          adversary to launch attacks specifically against
          Honeyd.  No remote root exploit is currently known.

Details:
=========

Honeyd is a virtual honeypot daemon that can simulate virtual hosts on
unallocated IP addresses.

A bug in handling NMAP fingerprints caused Honeyd to reply to TCP
packets with both the SYN and RST flags set.  Watching for replies, it
is possible to detect IP addresses simulated by Honeyd.

Although there are no public exploits known for Honeyd, the detection
of Honeyd IP addresses may in some cases be undesirable.

Solutions:
==========

A new version of Honeyd has been released to address this issue.
The source code for Honeyd 0.8 can downloaded from

  http://www.citi.umich.edu/u/provos/honeyd/

In addition, Honeyd 0.8 drops privileges if permitted by the
configuration file and contains command line flags to force dropping
of privileges.

Nontheless, it is suggested to run Honeyd in a chroot environment
under a sandbox like Systrace.

Thanks To
=========

Anonymous for information about the detection problem.

More Information:
=================

More information on Honeyd can be found at

  http://www.honeyd.org/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (OpenBSD)

iQEVAwUBQA49IzZ8FqYKL4flAQHbQQf+IvfxPWaXz2tPjfhN8oOkp4JhOdcGcfOw
AN8BVgvZxw9+AAv+r6kuuyIZMmJQwp4CfiYqh4b0A8Wq7pWb08g1GGQnnvAmnzgU
yjEJE0H1qm6cd3xftsGA5j+leWM/IfW+BWRPSwBtDqxSRzPGD+Tnkt43zqUE8f5i
+Owg9YDH2rFoomU0xzD5LHjaBDL89Ef8iU6YvRaVI2tix+GeINGUDkW20EtT1727
szP+y8XzsdaU3o+ZkqQ2s0uvJZyr0zzhenhuy9VGM9bvXq7NlcwUWyoJdQU6bZCl
rVZKc8mAjX6gRYLbSf0E5yE9HIxxOdXt9q9U1wRIXoOizn9V2Loanw==
=X/C4
-----END PGP SIGNATURE-----