Security

SecureLink Enterprise – Java 6 Update 26

0
June 17, 2011
by Michael McNamara in

We utilize SecureLink Enterprise to provide remote access to our vendors that support some of our servers. It’s a great solution that’s very cost effective and has worked very well. We probably have 200+ servers with the SecureLink Gatekeeper software installed. The solution utilizes a Java applet to provide a secure SSH tunnel via the web browser over which FTP Services, Desktop Sharing (Remote Desktop and VNC), Power Prompt and any number of customizable applications can run. It’s very easy to setup and provides two factor authentication utilizing the vendors email address along with a username and password combination.

We recently received a warning from SecureLink regarding the recent release of Java 6 Update 26;

There is a compatibility issue with the upgrade process from any previous version to Java 6 update 26 because of changes to some Java system files. Symptoms include connection errors, disappearing java applet window, session disconnects and java system errors. This issue occurs for both SecureLink Users and SecureLink Enterprise Vendor Representatives. SecureLink Users and SecureLink Enterprise Vendors can work around this problem by uninstalling and then manually re-installing Java or by rejecting Java 6 update 26.

Uninstall instructions http://www.java.com/en/download/uninstall.jsp

Manual Install Instructions http://www.java.com/en/download/help/windows_manual_download.xml

Cheers!

Domain Name Server patch

0
July 13, 2008
by Michael McNamara in

O'Reilly DNS and BIND Last week there was a flurry of information revolving around a new security flaw in the Domain Name System — software that acts as the central nervous system for the entire Internet.

On Tuesday July 10, 2008 a number of vendors including Microsoft, Cisco, Juniper and RedHat released patches and/or acknowledged the flaw existed. The Internet Software Consortium, the group responsible for development of the popular Berkeley Internet Domain Named (BIND) server from which nearly all DNS offshoots are based, also acknowledged the flaw and released a patch.

I personally spent about 90 minutes on last Wednesday updating several internal and external systems including numerous CentOS v5.2 servers and Windows 2003 Service Pack 2 servers. I was unable to find any mention of the DNS flaw on the Alcatel-Lucent website so I’ll probably need to place a call concerning Alcaltel-Lucent’s VitalQIP product.

I used yum to patch the CentOS Linux servers ["yum update"] and then just restarted the named process ["service named restart"]. On the Windows 2003 Service Pack 2 servers I used Windows Update to download and install KB941672 after which I rebooted the servers.

Here are some references:

http://www.theregister.co.uk/2008/07/09/dns_fix_alliance/
http://www.networkworld.com/news/2008/071008-patch-domain-name-servers-now.html
http://www.networkworld.com/news/2008/070808-dns-flaw-disrupts-internet.html

http://www.networkworld.com/podcasts/newsmaker/2008/071108nmw-dns.html

http://www.us-cert.gov/cas/techalerts/TA08-190B.html
http://www.microsoft.com/technet/security/bulletin/MS07-062.mspx

I would strongly suggest that all network administrators start looking into patching their DNS servers as soon as possible.

Cheers!

UPDATE: July 14, 2008

Here’s an update from RedHat concerning the configuration (named.conf) of BIND;

We have updated the Enterprise Linux 5 packages in this advisory. The default and sample caching-nameserver configuration files have been updated so that they do not specify a fixed query-source port. Administrators wishing to take advantage of randomized UDP source ports should check their configuration file to ensure they have not specified fixed query-source ports.

It seems that a check of the configuration file would be in order. Let me throw in a quick warning though if your DNS server is sitting behind a firewall you may need to check with the firewall administrator to understand how the firewall will behave if you randomize your source ports. I believe there are quite a few firewalls out there that only expect to see DNS traffic sourced from a DNS server on UDP/53.

Good Luck!

Go to Top