[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 26 Feb 2012 12:17:43 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Eric Leblond <eric@...it.org>
Subject: Re: Attack on badly configured Netfilter-based firewalls
On 02/25/2012 11:37 AM, Eric Leblond wrote:
> Hello,
>
> I've discovered a generic attack on firewall using Application
> Level Gateway (like Netfilter or Checkpoint).
>
> Impact: An attacker on a local network can open some pinholes in a
> firewall which is not correctly protected.
Are there any helpers that can be abused to open holes in the firewall
externally, or is it only internal clients that can cause problems and
trigger the firewall to improperly allow network traffic in/out.
> Fix: None, the issue has to be fixed in the firewall
> configuration. Workaround: Apply a strict anti-spoofing policy for
> IPv4 and IPv6 as described in the document "Secure use of iptables
> and connection tracking helpers" This document was written after
> private disclosure of the attack to the Netfilter's team.
Just to confirm: setting net.ipv4.conf.[IFNAME].rp_filter to 1 is
sufficient, it doesn't need to be set globally as well?
> This attack will be presented at Cansecwest, March 9th 2012.
I assume you won't be providing any specifics until this date? I can't
assign CVE's without more information so I guess we both just have to
wait.
> Secure use of iptables and connection tracking helpers:
> http://home.regit.org/netfilter-en/secure-use-of-helpers/
>
> Best regards,
--
Kurt Seifried Red Hat Security Response Team (SRT)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
