Re: DNS and Checkpoint

["Deniz Cevik" <Deniz.Cevik () intellect com tr>]

Yes, enable this feature at see what will happen. This check sometimes
drop valid dns request. 

 

________________________________

From: full-disclosure-bounces () lists grok org uk
[mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of Ray P
Sent: Thursday, July 10, 2008 4:35 AM
To: imipak; Full Disclosure
Subject: Re: [Full-disclosure] DNS and Checkpoint

 

The article you're looking at is for their SmartDefense product, an
add-in to Firewall-1. Supposedly it will protect a DNS server behind the
firewall from this vulnerability.

Ray

> Date: Wed, 9 Jul 2008 15:00:39 +0100
> From: imipak () gmail com
> To: full-disclosure () lists grok org uk
> Subject: [Full-disclosure] DNS and Checkpoint
>
> Hello everyone,
>
> I've had a report from someone with clue (and tcpdump) that a properly
> functioning DNS resolver that correctly uses randomised source ports
> magically becomes vulnerable once the traffic's passed through a
> Checkpoint firewall, where Dan Kaminsky's tool shows:
>
> x.y.z.155:56978 TXID=712
> x.y.z.155:56979 TXID=45713
> x.y.z.155:56980 TXID=63532
> x.y.z.155:56981 TXID=7243
> x.y.z.155:56982 TXID=17620
>
> (note the incrementing port numbers.)
>
> Can anyone else confirm this behaviour?
>
> Checkpoint are one of the dozens of vendors listed on the CERT
> advisory as "Status: Unknown"
> http://www.kb.cert.org/vuls/id/MIMG-7ECL6B
>
> They do have an advisory up:
http://www.checkpoint.com/defense/advisories/public/2008/cpai-01-Jul.htm
l
> I don't have the login needed to read the whole thing, but the front
> page just says:
>
> "Protection provided by:
> VPN-1: * NGX R65
> * NGX R62
> * NGX R61
> * NGX R60
> [...etc, etc...] "
>
>
> cheers
>
> =i
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

________________________________

Need to know now? Get instant answers with Windows Live Messenger. IM on
your terms.
<http://www.windowslive.com/messenger/connect_your_way.html?ocid=TXT_TAG
LM_WL_messenger_072008> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/