[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Honeyd Security Advisory 2004-001: Remote Detection Via Simple Probe Packet
-----BEGIN PGP SIGNED MESSAGE-----
Honeyd Security Advisory 2004-001
Topic: Remote Detection Via Simple Probe Packet
Version: All versions prior to Honeyd 0.8
Severity: Identification of Honeyd installations allows an
adversary to launch attacks specifically against
Honeyd. No remote root exploit is currently known.
Honeyd is a virtual honeypot daemon that can simulate virtual hosts on
unallocated IP addresses.
A bug in handling NMAP fingerprints caused Honeyd to reply to TCP
packets with both the SYN and RST flags set. Watching for replies, it
is possible to detect IP addresses simulated by Honeyd.
Although there are no public exploits known for Honeyd, the detection
of Honeyd IP addresses may in some cases be undesirable.
A new version of Honeyd has been released to address this issue.
The source code for Honeyd 0.8 can downloaded from
In addition, Honeyd 0.8 drops privileges if permitted by the
configuration file and contains command line flags to force dropping
Nontheless, it is suggested to run Honeyd in a chroot environment
under a sandbox like Systrace.
Anonymous for information about the detection problem.
More information on Honeyd can be found at
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (OpenBSD)
-----END PGP SIGNATURE-----