oss-sec mailing list archives
Re: Attack on badly configured Netfilter-based firewalls
From: Solar Designer <solar () openwall com>
Date: Mon, 27 Feb 2012 01:53:29 +0400
On Sun, Feb 26, 2012 at 10:05:55PM +0100, Eric Leblond wrote:
On Sun, 2012-02-26 at 12:17 -0700, Kurt Seifried wrote:Are there any helpers that can be abused to open holes in the firewall externally, or is it only internal clients that can cause problems and trigger the firewall to improperly allow network traffic in/out.No, attacker has to be on a network directly connected to the firewall.
I guess by "internal clients" Kurt was referring to machines behind the firewall (e.g., someone clicking an URL that has a string looking like an FTP command embedded in it, thereby triggering the FTP helper to open a hole - stuff that was discussed in late 1990s and partially mitigated by hardening the helpers at the time), whereas by "attacker on a network directly connected to the firewall" Eric means that the attacker may be _outside_ the firewall (behind its WAN interface), but on the same network segment (e.g., the attacker might have compromised a nearby server, such as of another customer at a colocation facility). It is known that a machine will generally receive and process a packet routed to one of its NICs by MAC address even if the destination IP address is that of another NIC or even loopback (e.g., it is possible to access services bound to 127.0.0.1 in this way - but only from directly connected machines). Without rp_filter or equivalent, it is possible to have these packets' source addresses match the other NIC's network segment. My _guess_ (based solely on the info posted in here so far) is that the gist of Eric et al.'s new attack is to apply this approach against a protocol helper. The novelty is thus in combining these known things together to arrive at something that to the best of my knowledge has not yet been discussed. I suppose Eric will tell us if this is the correct guess or not. ;-) Alexander
Current thread:
- Re: Attack on badly configured Netfilter-based firewalls, (continued)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Feb 27)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Mar 09)
- Re: Attack on badly configured Netfilter-based firewalls ArkanoiD (Mar 09)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Mar 09)
- Re: Attack on badly configured Netfilter-based firewalls Kurt Seifried (Mar 09)
- Re: Attack on badly configured Netfilter-based firewalls Jussi Eronen (Mar 02)
- Re: Attack on badly configured Netfilter-based firewalls Kurt Seifried (Mar 02)
- Re: Attack on badly configured Netfilter-based firewalls Jussi Eronen (Mar 20)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Feb 26)
- Re: Attack on badly configured Netfilter-based firewalls Solar Designer (Feb 26)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Feb 26)
- Re: Attack on badly configured Netfilter-based firewalls yersinia (Feb 27)
- Re: Attack on badly configured Netfilter-based firewalls Sebastian Krahmer (Feb 27)
- Re: Attack on badly configured Netfilter-based firewalls ArkanoiD (Feb 27)
- Re: Attack on badly configured Netfilter-based firewalls Sebastian Krahmer (Feb 27)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Feb 27)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Feb 28)