Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 27 Feb 2012 19:13:42 +0100
From: Florian Weimer <>
Subject: Re: Attack on badly configured Netfilter-based firewalls

* Eric Leblond:

> I've discovered a generic attack on firewall using Application Level
> Gateway (like Netfilter or Checkpoint).

This is rediscovered every two to five years.  Here's mine
(from 2005, but it's been proposed before):


> Secure use of iptables and connection tracking helpers:

I think your filters aren't effective against sandboxed Java code on
the client.

I think there are other client-side sandboxes which allow de-facto
unrestricted access (with server cooperation).  Doesn't Flash require
just a policy file on the server to open up arbitrary ports?

You could exclude the magic Silverlight port range:

| One additional restriction on using the sockets classes is that the
| destination port range that a network application is allowed to
| connect to must be within the range of 4502-4534.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.