Windows と Linux のセキュリティ : 噂の真相

  • View
    28

  • Download
    0

Embed Size (px)

DESCRIPTION

Windows と Linux のセキュリティ : 噂の真相. 日本 Windows NT ユーザ会 (JWNTUG) Event Planning Working Group 小島 肇. 今日のおはなし. 噂 1: Linux は Windows よりも安全だ 噂 2: Apache は IIS よりも安全だ 噂 3: Netscape / Mozilla, Opera は IE よりも安全だ 噂 4: Microsoft はセキュリティ fix が遅いしセキュリティ情報も開示しない まとめにならないまとめ. 念のため. - PowerPoint PPT Presentation

Text of Windows と Linux のセキュリティ : 噂の真相

  • Windows Linux : Windows NT (JWNTUG)Event Planning Working Group

  • 1: Linux Windows 2: Apache IIS 3: Netscape / Mozilla, Opera IE 4: Microsoft fix

  • JWNTUG JWNTUG at your own risk

  • 1:Linux Windows

  • (1)Eiji James Yoshida Open Port (TCP) (2002.05.01-31) [*] :[*] http://www.geocities.co.jp/SiliconValley/1667/index.htm

    OS (/1111)Windows 316Linux314Linux UNIX 178 ()303

  • (2)SecurityFocus.com 2002 Q1 TOP 10 attacks [*]Code Red - MS Indexing Server/Indexing Services ISAPI Buffer Overflow Attack Nimda - Microsoft IIS 4.0/5.0 Extended UNICODE Directory Traversal Attack Matt Wright Formmail Attack WU-FTPD File Globbing Heap Corruption Attack SSH CRC32 Compenation Detection Attack Generic CDE dtspcd Buffer Overflow Attack Generic System V Derived Login Buffer Overflow Attack Generic SNMP PROTOS Test Suite Attacks Shaft DDoS Client To Handler Attack PHP Post File Upload Buffer Overflow Attack [*] http://www.securityfocus.com/corporate/research/ top10attacks_q1_2002.shtml

  • (3)2002.01.012002.06.10 fix ! : patch (Sun)

    OS / patch Microsoft26RedHat Linux 7.246Debian GNU/Linux35Sun6FreeBSD27

  • : Linux OS security hole fix B "Trusted OS" security hole fix web web

  • : Open Source Closed Source Open Source Open Source Open Source fix and/or Use the source, Luke!

  • 2: Apache IIS

  • IIS MS00-078/086/01-026: UNICODE BUGMS01-023: IPP ISAPI buffer overflowMS01-033: Index server buffer overflowMS01-035: FrontPage Server Extensions buffer overflowMS01-044: cumulative patch (SSI buffer overflow )MS02-018: cumulative patch (ASP chunk encoding / HTTP header / SSI / .HTR buffer overflow, CSS )MS02-028: Heap overrun in HTR Chunked Encoding

  • Web JWNTUG IIS 7% 2%34%26% 18%Apache22%13%14% 7% 12% IIS vs. apache

  • Apache bug free 1.3.12: fix1.3.14: virtual hosting Host: CGI 1.3.22: Host: .log Apache hosting 1.3.13 Win32 1.3.24: Win32 Apache Remote command execution

  • Apache bug free () 3rd party PHPPHP 4 .htaccess attribute transfer vuln. (bid 2206)PHP 4 engine disable source viewing vuln. (bid 2205)PHP post file upload buffer overflow (bid 4183)WebDAVmod_encoding (20011026a, 20011211a)mod_sslbuffer overflow (bid 4189)Apache tomcat (bid 2982)

  • web application web SSI, CGI, ASP, JSP, PHP, ColdFusion, get cookie cookie (virtual ?!)

  • : IIS Apache IIS Apache file/directory ISAPI IIS Lockdown, URLScan, guard 3 patch IIS Apache IIS 6 (^^;;)

  • 3: Netscape / Mozilla, Opera IE

  • IE MS02-005 / 008 / 009 / 013 / 015 / 022 / 023 / 027 patch MS02-022 MSN 02-013 Java VM IE patch HTML (MS02-023 fix )gopher:// buffer overflow (bid 4930, MS02-027)ftp:// (bid 4954)Unpatched IE security holes: http://jscript.dk/Unpatched/

  • Netscape, Opera ?IE Netscape 6.16.2.2 / mozilla 0.9.71.0RC1 Opera 6.01 cookie / Opera 6.01, 6.02 Opera ! fix Netscape

  • IE bug MIME Content-Type: Content-Type: text/plain fusianasan (.gif )Opera microsoft.com ()

  • : Netscape, Opera = WWW IE Netscape / Opera IE ? Opera Netscape IE 3rd party ?web OS ! ()OS ()

  • 4: Microsoft fix

  • ftp:// (bid 4954)IE FTP Explorer web 2 () ftp:// URL

  • () OS PC98x1 48hIE 1.52 fix OS 34 ?MS02-024 (DebPloitNT/2000) 2.5 MS02-017 (Multiple UNCNT/2000/XP) 5.5

  • : LAC Content-Disposition Microsoft LAC http://www.lac.co.jp/security/intelligence/SNSAdvisory/48.htmlMicrosoft 3rd party software http://www.microsoft.com/technet/security/topics/snsrprt.asp Microsoft TechNet Security link MS02-023 fix

  • Microsoft web page ()mail () ()?CVE () e-mail ; secure@microsoft.com (0120-69-0196) 9:30-12:00, 13:00-19:00MSKK 24h

  • Microsoft ()OEM watch Microsoft Microsoft, OEM , 3rd partyMicrosoft OEM ?Software Update Services ?

  • : ! (by )1 fix ? 1 1 Guninski () 2 ()Sun

  • Microsoft Linux / Open Source djb ?djbdns, qmail, (http://cr.yp.to)Windows Windows Open Source !

  • 1999 2000 CodeRed / Nimda patch ! secure .NET ??!

  • Windows NT (JWNTUG)http://www.jwntug.or.jp/index-j.html: Mailing List Security ML JWNTUG Newsletter eventMicrosoft Conference (MSC) JWNTUG Open Talk Microsoft BOF in Internet WeekWe need you!

  • Appendix

  • URL - MicrosoftMicrosoft Technet :http://www.microsoft.com/technet/security/:http://www.microsoft.com/japan/technet/security/ (HFNetChk, URLScan ):http://www.microsoft.com/japan/technet/security/tools/tools.aspSecurity Bulletin: MSxx-xxx:http://www.microsoft.com/technet/security/bulletin/MSxx-xxx.asp:http://www.microsoft.com/japan/technet/security/prekb.asp?sec_cd=MSxx-xxx

  • URL - MicrosoftMicrosoft (Knowledge Base) (Qxxxxxx):http://www.microsoft.com/technet/support/kb.asp?ID=xxxxxx (JPxxxxxx, Jxxxxxx):http://www.microsoft.com/japan/support/kb/artivles/JPxxx/x/xx.htmhttp://www.microsoft.com/japan/support/kb/artivles/Jxxx/x/xx.htm

  • URL web pageUS CERT/CC ()http://www.cert.org/CERT/CC Incident Noteshttp://www.cert.org/incident_notes/CIAC ()http://www.ciac.org/JPCERT/CChttp://www.jpcert.or.jp/IPA http://www.ipa.go.jp/security/

  • URL web pageCVEhttp://www.cve.mitre.org/CAN-XXXX-XXXhttp://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-XXXX-XXXBUGTRAQ bugid XXXXhttp://www.securityfocus.com/bid/XXXXApache Week Apache httpd 1.3 vulnerabilitieshttp://www. apacheweek.com/features/security-13PHPhttp://www.php.net/

  • URL web pageRedHathttp://www.jp.redhat.com/support/errata/Debianhttp://www.debian.org/security/FreeBSDhttp://www.freebsd.org/security/Sunhttp://sunsolve.sun.com/pub-cgi/secBulletin.pl

  • URL web pageNetscape Security Centerhttp://wp.netscape.com/security/http://wp.netscape.com/ja/security/Operahttp://www.opera.com/support/service/security/http://www.jp.opera.com/support/service/security/Georgi Guninski Security Researchhttp://www.guninski.com/

  • URL web page Windows NT (JWNTUG)http://www.jwntug.or.jp/port139http://www.port139.co.jp/Win http://winsec.toranoana.ne.jp/ memohttp://www.st.ryukoku.ac.jp/~kjm/security/memo/http://www.st.ryukoku.ac.jp/~kjm/security/antenna/ZDNet Helpdesk Security How-Tohttp://www.zdnet.co.jp/help/howto/security/

  • URL BUGTRAQ ()http://www.securityfocus.com/NTBUGTRAQ ()http://www.ntbugtraq.com/ memo MLhttp://memo.st.ryukoku.ac.jp/Security Talk MLhttp://www.office.ac/Security_Talk_ML_Guide.html24 MLhttp://cn24h.hawkeye.ac/connect24h.htmlport139 ML ()http://www.port139.co.jp/ntsec_ml.htm

    George Guninski: http://www.guninsiki.comdjb = D. J. Bernstein