Letters

Managed Security System—A Mechanism that CentrallyReconfigures Associated Hosts Based on New Vulnerability Alerts
Fumiyuki Tanemo†, Hideo Sakuma, and Masao Tanabe
Abstract
To keep the network secure, system administrators must constantly be aware of every new vulnerability alert and manually apply the corresponding countermeasures in their systems. This article presents amanaged security system that can simplify such tasks by centrally reconfiguring associated hosts whena new alert is received.

1. Increase in security risks
As the Internet becomes prevalent, the damage
caused by illegal access and denial-of-service (DoS)
attacks is increasing. When security weaknesses exist
in the host computers or local networks connected to
the Internet, problems such as information leakage,falsification, and system breakdown can be caused byvarious security attacks. Furthermore, rectifying thedamage frequently requires troublesome effort.
2. Problems with current security management
Although security devices such as firewalls*1 andintrusion detection systems (IDS)*2 are somewhat
effective against some network threats, most security
attacks exploit the weaknesses of host computerssuch as software vulnerabilities or configuration
errors. Therefore, it is necessary to correct the weaknesses on the host computers as soon as possible.
However, new security weaknesses are found every
day and made public as vulnerability alerts. It is noteasy for administrators to confirm whether there is aproblem for each vulnerability alert in the host computers and apply the corresponding countermeasures
to them continuously. Moreover, when the security
measure is done inadequately, important functions on
the host computer may not operate or a more serioussecurity problem might occur. Therefore, sufficient† NTT Information Sharing Platform Laboratories
Musashino-shi, 180-8585 Japan
E-mail: tanemo.fumiyuki@lab.ntt.co.jp

Vol. 1 No. 6 Sep. 2003

knowledge and experience are required to apply thesecurity countermeasures appropriately. We also
believe that many enterprises have too few engineers
skilled in the necessary security management, which
increases the damage caused by security breaches.
3. Managed Security System (MSS)Managing the security of the host computerrequires inspecting security weaknesses on it andapplying necessary countermeasures to it accuratelyand efficiently. To make such management easier, weare undertaking research and development of a managed security system (MSS) that centrally diagnoses
and reconfigures all associated host computers basedon vulnerability alerts (Fig. 1). It first confirms
whether the host computer has the security weaknesses corresponding to the registered vulnerability
alerts. Then, if these weaknesses are found, the system executes the corresponding countermeasures,such as changing the host computer’s configurationor the policies of the firewall and IDS. It also aims toselect and execute an appropriate action within the*1 Firewall: a system that defends internal networks against network
threats by controlling the reachability of network packets according to a policy decided beforehand. The firewall passes only packets that are permitted by the policy and blocks the packets prohibited by the policy.
*2 Intrusion detection system (IDS): a system that detects security
attacks or malicious acts and alerts network manager by continuously observing packets on the network or auditing user behavior
on host computers. In general, an IDS has a policy that defines
what it should inspect from a large history of attack patterns.

87Letters

range available that does not inconvenience network
users.

4.3 Countermeasures
Most countermeasures described in vulnerability
alerts can be classified into the following six categories.
1. Upgrade the version
2. Install a patch

4. Vulnerability alert

Figure 2 shows an example of a general vulnerability alert. This section surveys the main aspects ofManaged security systemvulnerability alerts and· Inspect security weakness
explains their usage in(check host configuration, etc.)· Select countermeasure
MSS.

Och btaan inge /· Execute countermeasure

4.2 Target software,version
In general, each vulnerability alert lists the versionof the target software andthe operating systems thatwill and will not be affected. One can judge whether
or not there is a weakness
in the software from thisversion information. MSS
registers the software nameand version information as
searchable items corresponding to the vulnerability alert in the database,which allows the system tocheck the vulnerability ofthe host computer.

Security Refer
database

Obtain/changeRefer

New alert of Registeredvulnerability

n/ai ebt gO hanc

4.1 Name, details,effects
These are generaldescriptions of each vulnerability alert. They mention the target system, theeffects of the vulnerability,
level of emergency, andsome other technical information. The system administrator often judges
whether or not his/her system has security weaknesses based on this information. MSS provides thisinformation in plain English, so the system administrator can understand it
easily.

Host computer(containing OSand applications)

Hostconfiguration

Policy offirewallFirewall

IDS
Policy of
IDS···User policy
database
IDS: Intrusion detection system

Fig. 1. Conceptual framework of managed security system (MSS).

CERT® Advisory CA-2001-27
Format String Vulnerability in CDE ToolTalk
Overview
There is a remotely exploitable format string vulnerability in the
CDE ToolTalk RPC database service. This vulnerability could be
used to crash the service or execute arbitrary code, potentially allowing an intruder to gain root access.
I. Description
The Common Desktop Environment (CDE) is an integrated
graphical user interface that runs on Unix and Linux operatingsystems. ....

(1) Name, description

II. Impact
An attacker can execute arbitrary code with the privileges of therpc.ttdbserverd process, typically root.
III. Solution
Apply a patch
Appendix A contains information from vendors who have provided
information for this advisory. ...

(3) Countermeasures

Block access to vulnerable service
Until patches are available and can be applied, you may wish toblock access to the RPC portmapper service and the ToolTalk
RPC service from untrusted networks such as the Internet. ...
Appendix A
HP: HP-UX 10.10, 10.20, 10.24, 11.00, 11.04, 11.11
IBM AIX 4.3, 5.1
Compaq Tru64 DIGITAL UNIX v4.0f, v4.0g, v5.0a, v5.1, v5.1a
Sun Solaris 7, 8(2) Software, versions

CERT/CC Advisory “Format String Vulnerability in CDE ToolTalk”
Original release date: October 5, 2001, Source: CERT/CC

Fig. 2. Example of vulnerability alert.

88

NTT Technical Review

Letters

Table 1. Example of data in security database.
Name

Description

OSs

Versions

Format string
vulnerability inCDE ToolTalk

There is a remotely exploitable format
string vulnerability in the CDE ToolTalk
RPC database service.

HPHP-UXIBMAIX
Compaq Tru64Sun
SolarisHP-UX 10.10, 10.20,10.24, 11.00, 11.04,
11.11 AIX 4.3, 5.1
Compaq Tru64

Patches
Solaris5.8 110286-04
Solaris5.7 107893-15
Solaris5.6 105802-16

Countermeasures

Executable script(1) Apply a patch(2) Block access to vulnerable service

3. Modify the configuration file
4. Modify file permissions
5. Modify program execution options
6. Terminate service
MSS maintains the countermeasures as executableinternal control information to automate the actions.
Table 1 shows examples of the database items corresponding to some vulnerability alerts in MSS.

RUN chmod 0 rpc.ttdbserverd

Firewalls and IDSs are configured based on this policy. Before selecting and applying countermeasures,
MSS extracts each host computer’s actual configuration, which includes the operating system’s configuration files and a list of security patches that havealready been applied. The host configuration to beextracted is stored in the database, and the system candiagnose host computers by checking this host configuration upon each vulnerability alert.

5. Security functions
MSS provides two main security functions: setting
the initial security level and updating security basedon recent vulnerability alerts.
5.1 Initial security setting function
To make the user network secure, the user policy
should be defined first and each host computer should
be diagnosed and reconfigured based on existing vulnerability alerts. Moreover, firewalls and IDSs should
be set according to the user policy.
MSS provides the initial security setting functionthat does this along with user network registration by
the user him/herself. The sequence of the initial security setting function is as follows.
(1) Register the network information regarding theuser network (addresses and domains, etc.) andthe user policy.
(2) Register each host computer’s initial configuration(3) Set the policy of firewalls and IDSs.
(4) Extract the host configuration from each hostcomputer.
(5) Check the host configuration based on vulnerability alerts.
(6) If the host configuration has security weaknesses,select and apply countermeasures based on theuser policy and host computer’s initial configuration to the host computer.
The user policy defines services such as WWW,
DNS, and mail, which the host computer provides.
Vol. 1 No. 6 Sep. 2003

5.2 Security update function
To keep the user network secure, the system administrator must respond to all vulnerability alerts immediately. To make this possible, MSS provides a security update function that diagnoses and reconfigures
the managed host computers as soon as a new vulnerability alert is registered. Although vulnerability
alerts must be registered by the administrator, once
one has been registered in the security database, theselection and application of countermeasures basedon it is performed automatically on all associated hostcomputers simultaneously. The sequence of the security update function is as follows.
1. Register a new vulnerability alert in the database.
2. Extract the host configuration from each hostcomputer.
3. Check the host configuration based on the vulnerability alert.
4. If the host configuration has security weaknesses,
select and apply countermeasures to the host computer.
MSS provides a graphical user interface that lets thesystem administrator check the history of security
updates for managed host computers.
6. Architecture
MSS consists of two main subsystems: the gateway-agent module can keep many host computers
secure and host-agent modules are installed on themanaged host computers. It can cooperate with exist89

Letters

ing firewalls and IDSs. Figure 3
shows the architecture of MSS.
6.1 Gateway-agent moduleThis module, which is usually
installed on a particular management system, diagnoses all managed host computers. If a security
weakness is found in any hostcomputer, it directs the host-agentof the host computer to executethe corresponding countermeasures. It also has a security database for storing vulnerability
alerts.
The system administrator canset policies for firewalls and IDSs
and diagnose and reconfigure themanaged host computers by setting the user network informationand the user policy on this gateway-agent module. When a newvulnerability alert is published,
the administrator registers it in
the security database of the gateway-agent module, so the module
checks host computers according
to the alert.
6.2 Host-agent module
MSS needs a host-agent module installed on each host computer that is managed by the system.
The module executes someprocesses under the instructionsof the gateway-agent module on
the management system, including sending the host configuration
to the gateway-agent module andexecuting countermeasures distributed by the gateway-agent
module.

Registervulnerability alert

Internet

Security
database

Management centerSet the policies
of firewall and IDS
ProviderIDS

Managementsystem

FirewallExtract the host configuration,
Distribute countermeasures

Aggregator

UserRegister
user policy

Gateway-agent
moduleHost-agent
moduleHost-agent
moduleHost 1

Host 2Host-agent
moduleHost 3User network

Fig. 3. Architecture of MSS.

Internet

DNS server
Firewall manager

Firewall module

Managementsystem(gateway-agentmodule)
Provider network
Hub
IDS manager

IDS sensor

AggregatingrouterRouter
User 1(host-agentmodule)

User 2(host-agentmodule)

Fig. 4. Application to user networks.

7. Application to user networks
Figure 4 shows a network topology example inwhich MSS is applied to user networks. It can manage host computers running Windows 2000 Server or
Solaris as the managed host computers. After configuring the initial minimum settings of a host computer
including network settings, the system administrator
introduces the host-agent module into the host com90

puter. Next, the system administrator sets the initial
security of the gateway-agent module on the management system. Thus, the policies of firewalls and IDSs
are set according to the user policy, and the host computer will be made secure by executing each countermeasure that the gateway-agent module distributes.
When a new vulnerability alert is found and the system administrator registers it in the security database,
NTT Technical Review

Letters

the security update function is executed on the system, and the action corresponding to the problem isachieved. This execution makes the security states ofall host computers up-to-date.
8. Future development
The current version of MSS can be applied only toa limited number of operating systems, server software types, firewalls, and IDSs, so we plan to expand
the target system coverage and generalize the system
by making a cooperation protocol between modules
that are standardized in the future.

Fumiyuki Tanemo
Research Engineer, NTT Information Sharing
Platform Laboratories.
He received the B.S. and M.S. degrees in information engineering from Nagoya University,Nagoya in 1991, 1993, respectively. In 1993, hejoined NTT Network and Information Systems
Laboratories, Tokyo, Japan. In 1999, he joined
NTT Information Sharing Platform Laboratories.
He is a member of the Information Processing
Society of Japan and IEEE Computer Society.

Hideo Sakuma
NTT Information Sharing Platform Laboratories.
He received the B.S. degree in communicationengineering from Tokai University, Tokyo in1995. In 1988, he joined NTT, Tokyo, Japan. In
2001, he joined NTT Information Sharing Platform Laboratories.

Masao Tanabe
Senior Research Engineer, NTT Information
Sharing Platform Laboratories.
He received the B.S. and M.S. degrees in communication engineering from Waseda University, Tokyo in 1985 and 1987, respectively. In
1987, he joined NTT, Tokyo, Japan. In 1999, hejoined NTT Information Sharing Platform Laboratories. He is a member of the Institute of Electronics, Information and Communication Engineers of Japan and IEEE Computer Society.

Vol. 1 No. 6 Sep. 2003

91