<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="PL" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Dear Shrew support team,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">We are planning to use your software VPN client in our company, but we need to follow up our security procedures. From that reason, I would like to ask for few topics regarding your software. Please take a look at below
questions and let us know your comments.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thank you very much in advance.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><i><span lang="EN-US" style="color:#1F497D">3) Please let us know if split tunneling is disabled<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US" style="color:#1F497D">4) Please let us know if the Shrew VPN Client is an licensed software. If yes then please provide vendor confirmation mail that below security risk has been mitigated by appropriate security fixes/patches<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US" style="color:#1F497D">Risk<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US" style="color:#1F497D">1) For the Shrew VPN client the CVE-2010-3361 identified the CVSS score of 6.9<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US" style="color:#1F497D">It defines that (1) iked, (2) ikea and (3) ikec scripts in shrew Soft IKE 2.1.5 would place a zero length directory name in the LD_LINRARY_PATH which allows local users to gain privileges via
a Trojan Horse shared library in the current working directory<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US" style="color:#1F497D">2) For the shrew VPN client OS<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US" style="color:#1F497D">weak_phase1_check (on | off);
<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US" style="color:#1F497D">Tells racoon to act on unencrypted deletion messages for phase 1. This is a small security risk, so the default is off, meaning that racoon will keep on trying to establish a connection even if
the user credentials are wrong, for instance.<o:p></o:p></span></i></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;mso-fareast-language:PL">Pozdrawiam/Best regards<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;mso-fareast-language:PL">Arkadiusz Kucharski<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;mso-fareast-language:PL">EMEA Data Network Engineer<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;mso-fareast-language:PL">NOS – Network Engineering and Deployment<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;mso-fareast-language:PL">Accenture Services Sp. z o.o.<o:p></o:p></span></p>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1">This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the
original. Any other use of the e-mail by you is prohibited.<br>
<br>
Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance
with Accenture policy.<br>
<br>
______________________________________________________________________________________<br>
<br>
www.accenture.com<br>
</font>
</body>
</html>