Re: DNS and Checkpoint

["Sandro Gauci" <sandro () enablesecurity com>]

The question is - is this feature (src port randomization) enabled by
default?

On Thu, Jul 10, 2008 at 9:00 AM, Deniz Cevik <Deniz.Cevik () intellect com tr>
wrote:

>  Yes, enable this feature at see what will happen. This check sometimes
> drop valid dns request.
>
>
>  ------------------------------
>
> *From:* full-disclosure-bounces () lists grok org uk [mailto:
> full-disclosure-bounces () lists grok org uk] *On Behalf Of *Ray P
> *Sent:* Thursday, July 10, 2008 4:35 AM
> *To:* imipak; Full Disclosure
> *Subject:* Re: [Full-disclosure] DNS and Checkpoint
>
>
>
> The article you're looking at is for their SmartDefense product, an add-in
> to Firewall-1. Supposedly it will protect a DNS server behind the firewall
> from this vulnerability.
>
> Ray
>
> > Date: Wed, 9 Jul 2008 15:00:39 +0100
> > From: imipak () gmail com
> > To: full-disclosure () lists grok org uk
> > Subject: [Full-disclosure] DNS and Checkpoint
> >
> > Hello everyone,
> >
> > I've had a report from someone with clue (and tcpdump) that a properly
> > functioning DNS resolver that correctly uses randomised source ports
> > magically becomes vulnerable once the traffic's passed through a
> > Checkpoint firewall, where Dan Kaminsky's tool shows:
> >
> > x.y.z.155:56978 TXID=712
> > x.y.z.155:56979 TXID=45713
> > x.y.z.155:56980 TXID=63532
> > x.y.z.155:56981 TXID=7243
> > x.y.z.155:56982 TXID=17620
> >
> > (note the incrementing port numbers.)
> >
> > Can anyone else confirm this behaviour?
> >
> > Checkpoint are one of the dozens of vendors listed on the CERT
> > advisory as "Status: Unknown"
> > http://www.kb.cert.org/vuls/id/MIMG-7ECL6B
> >
> > They do have an advisory up:
> http://www.checkpoint.com/defense/advisories/public/2008/cpai-01-Jul.html
> > I don't have the login needed to read the whole thing, but the front
> > page just says:
> >
> > "Protection provided by:
> > VPN-1: * NGX R65
> > * NGX R62
> > * NGX R61
> > * NGX R60
> > [...etc, etc...] "
> >
> >
> > cheers
> >
> > =i
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>  ------------------------------
>
> Need to know now? Get instant answers with Windows Live Messenger. IM on
> your terms.<http://www.windowslive.com/messenger/connect_your_way.html?ocid=TXT_TAGLM_WL_messenger_072008>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/