Re: Attack on badly configured Netfilter-based firewalls

[Yves-Alexis Perez <corsac () debian org>]

On sam., 2012-02-25 at 19:37 +0100, Eric Leblond wrote:
> Impact:
> An attacker on a local network can open some pinholes in a firewall
> which is not correctly protected.
> Fix:
> None, the issue has to be fixed in the firewall configuration.
> Workaround:
> Apply a strict anti-spoofing policy for IPv4 and IPv6 as described in
> the document "Secure use of iptables and connection tracking helpers" 
> This document was written after private disclosure of the attack to the
> Netfilter's team.

Did you check how the various frontends to iptables (ferm, ufw,
shorewall and the gazillon others)? They might generate an “insecure”
ruleset and might be candidate to a fix.

Regards,
-- 
Yves-Alexis

Attachment: signature.asc
Description: This is a digitally signed message part