oss-security - Attack on badly configured Netfilter-based firewalls

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1330195034.8332.125.camel@tiger.regit.org>
Date: Sat, 25 Feb 2012 19:37:14 +0100
From: Eric Leblond <eric@...it.org>
To: oss-security@...ts.openwall.com
Subject: Attack on badly configured Netfilter-based firewalls

Hello,

I've discovered a generic attack on firewall using Application Level
Gateway (like Netfilter or Checkpoint).

Impact:
An attacker on a local network can open some pinholes in a firewall
which is not correctly protected.
Fix:
None, the issue has to be fixed in the firewall configuration.
Workaround:
Apply a strict anti-spoofing policy for IPv4 and IPv6 as described in
the document "Secure use of iptables and connection tracking helpers" 
This document was written after private disclosure of the attack to the
Netfilter's team.

This attack will be presented at Cansecwest, March 9th 2012.

Secure use of iptables and connection tracking helpers:
http://home.regit.org/netfilter-en/secure-use-of-helpers/

Best regards,
-- 
Eric Leblond 
Blog: http://home.regit.org/

Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.