Honeyd Security Advisory 2004-001
=================================

Topic:    Remote Detection Via Simple Probe Packet

Version:  All versions prior to Honeyd 0.8

Severity: Identification of Honeyd installations allows an
	  adversary to launch attacks specifically against
          Honeyd.  No remote root exploit is currently known.

Details:
=========

Honeyd is a virtual honeypot daemon that can simulate virtual hosts on
unallocated IP addresses.

A bug in handling NMAP fingerprints caused Honeyd to reply to TCP
packets with both the SYN and RST flags set.  Watching for replies, it
is possible to detect IP addresses simulated by Honeyd.

Although there are no public exploits known for Honeyd, the detection
of Honeyd IP addresses may in some cases be undesirable.

Solutions:
==========

A new version of Honeyd has been released to address this issue.
The source code for Honeyd 0.8 can downloaded from

  http://www.citi.umich.edu/u/provos/honeyd/

In addition, Honeyd 0.8 drops privileges if permitted by the
configuration file and contains command line flags to force dropping
of privileges.

Nontheless, it is suggested to run Honeyd in a chroot environment
under a sandbox like Systrace.

Thanks To
=========

Anonymous for information about the detection problem.

More Information:
=================

More information on Honeyd can be found at

  http://www.honeyd.org/