oss-sec mailing list archives
Re: Attack on badly configured Netfilter-based firewalls
From: Eric Leblond <eric () regit org>
Date: Sat, 25 Feb 2012 23:16:06 +0100
Hello, On Sat, 2012-02-25 at 21:10 +0100, Yves-Alexis Perez wrote:
On sam., 2012-02-25 at 19:37 +0100, Eric Leblond wrote:Impact: An attacker on a local network can open some pinholes in a firewall which is not correctly protected. Fix: None, the issue has to be fixed in the firewall configuration. Workaround: Apply a strict anti-spoofing policy for IPv4 and IPv6 as described in the document "Secure use of iptables and connection tracking helpers" This document was written after private disclosure of the attack to the Netfilter's team.Did you check how the various frontends to iptables (ferm, ufw, shorewall and the gazillon others)? They might generate an “insecure” ruleset and might be candidate to a fix.
I've done some research on various frontend to iptables. Most of them were secure for IPv4 but the IPv6 case was more complicated. But given the fact there is a gazillon of them this was difficult to check them all. On Netfilter side, we've decided to publish the document explaining how to secure helpers to explain how to fix this. It was some months ago and I hope it has been read. I've contacted the frontend developers and Netfilter/Linux firewalls vendors I knew to have them test their software/equipment. I've started this some months ago. I've also tried to contact the various CERT but they refused to handle the case or did not reply to my requests. BR, -- Eric Leblond Blog: http://home.regit.org/
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Attack on badly configured Netfilter-based firewalls Eric Leblond (Feb 25)
- Re: Attack on badly configured Netfilter-based firewalls Yves-Alexis Perez (Feb 25)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Feb 26)
- Re: Attack on badly configured Netfilter-based firewalls Eugene Teo (Feb 26)
- Re: Attack on badly configured Netfilter-based firewalls Solar Designer (Feb 26)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Feb 27)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Mar 09)
- Re: Attack on badly configured Netfilter-based firewalls ArkanoiD (Mar 09)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Mar 09)
- Re: Attack on badly configured Netfilter-based firewalls Kurt Seifried (Mar 09)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Feb 26)
- Re: Attack on badly configured Netfilter-based firewalls Yves-Alexis Perez (Feb 25)
- Re: Attack on badly configured Netfilter-based firewalls Jussi Eronen (Mar 02)
- Re: Attack on badly configured Netfilter-based firewalls Kurt Seifried (Mar 02)
- Re: Attack on badly configured Netfilter-based firewalls Jussi Eronen (Mar 20)