Security assessment of the Cataloguing Client

Background

The Libraries Australia Cataloguing Client is used by libraries around Australia to contribute records to the Australian National Bibliographic Database at the National Library of Australia. In 2005,the Client replaced a client which had been used since 1998. The Client uses a proprietary PICA3 protocol. A security assessment has been prepared for the National Library of Australia by a security expert to ensure that all security issues could be assessed and information provide to libraries. This document summarises the findings of the assessment.

Installation Information

1. Application Installation

The changes made to the user's desktop/laptop computer during the Libraries Australia Cataloguing Client installation process are listed below:

1.1 File System Changes

The Libraries Australia Cataloguing Client installs files in the following locations:

  • C:\Program files\LACC
  • C:\Documents and Settings\%User%\Start Menu\Programs\Libraries Australia Cataloguing Client

The figure below shows the sub-directories created in the LACC directory: sub-directories created in the LACC

1.2 Registry Changes

The application adds and writes values to the following Registry Key locations:

  • HKEY_CLASSES_ROOT\Interface\
  • HKEY_CLASSES_ROOT\TypeLib\
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\
  • HKEY_CURRENT_USER\Software\OCLCPica\WinIBW30\Settings
  • HKEY_CURRENT_USER\Software\OCLCPica\WinIBW30\Software\Pica\WinIBW30

1.3 Uninstall the Application

The Libraries Australia Cataloguing Client has an Uninstall process and is used to remove the application from the file system and the registry.

2. Application Operation

2.1 File Access

The Libraries Australia Cataloguing Client accesses the following files:

  • C:\Program Files\LACC
  • C:\WinNt\Fonts

2.2 Registry Access

The Libraries Australia Cataloguing Client performs OpenKey and QueryValue registry operations. With the exception of the installation process, no functions performed SetValue or CreateKey operations.

2.3 Application Conflicts

The Libraries Australia Cataloguing Client does not conflict or impact with any other systems or applications running on the desktop. The Libraries Australia Cataloguing Client utilises minimal memory resources.

2.4 Exploits

The Libraries Australia Cataloguing Client does not open any inbound listening ports.

Assessment

The Libraries Australia Cataloguing Client was tested using the following methodology:

  • Measurement of registry changes, file system changes and network activity when installing the client.
  • Development of a test plan.
  • Testing using the test plan.
  • Measurement at each stage of the test plan.
  • Analysis of data captured.

Assessment Findings

  • Registry changes: The Libraries Australia Cataloguing Client did not conflict or impact with any other systems or applications running on the desktop. The Libraries Australia Cataloguing Client utilised minimal memory resources during the testing.
  • Application installation, vulnerability assessment: Application installation of files was assessed as VERY LOW risk rating. Application addition of entries into the registry was assessed as VERY LOW risk rating.
  • Network communication, client side communication: Application requires outbound TCP session to server on port 1521 (production system) and port 1840 (training system). This was assessed as LOW – MEDIUM risk rating. Three mitigation strategies were recommended: establishing an outbound firewall rule on port 1521 to192.102.239.210 (production) and port 1840 to 192.102.239.207(training); establishing this from specific workstations; and, maintaining a log of events. This was assessed as a LOW risk rating.
  • The Application also requires an outbound session to {insert production URL/IP} on port 80. This was assessed as a LOW risk rating.

The National Library has ensured that all security risks for the Libraries Australia Cataloguing Client users are low and will ensure that risks are reviewed regularly by a qualified external organisation.

Any library which requires further information or discussion should contact the Help Desk.