[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1330208166.25432.16.camel@tiger.regit.org>
Date: Sat, 25 Feb 2012 23:16:06 +0100
From: Eric Leblond <eric@...it.org>
To: oss-security@...ts.openwall.com
Subject: Re: Attack on badly configured Netfilter-based
firewalls
Hello,
On Sat, 2012-02-25 at 21:10 +0100, Yves-Alexis Perez wrote:
> On sam., 2012-02-25 at 19:37 +0100, Eric Leblond wrote:
> > Impact:
> > An attacker on a local network can open some pinholes in a firewall
> > which is not correctly protected.
> > Fix:
> > None, the issue has to be fixed in the firewall configuration.
> > Workaround:
> > Apply a strict anti-spoofing policy for IPv4 and IPv6 as described in
> > the document "Secure use of iptables and connection tracking helpers"
> > This document was written after private disclosure of the attack to the
> > Netfilter's team.
> >
>
> Did you check how the various frontends to iptables (ferm, ufw,
> shorewall and the gazillon others)? They might generate an “insecure”
> ruleset and might be candidate to a fix.
I've done some research on various frontend to iptables. Most of them
were secure for IPv4 but the IPv6 case was more complicated. But given
the fact there is a gazillon of them this was difficult to check them
all. On Netfilter side, we've decided to publish the document
explaining how to secure helpers to explain how to fix this. It was some
months ago and I hope it has been read.
I've contacted the frontend developers and Netfilter/Linux firewalls
vendors I knew to have them test their software/equipment. I've started
this some months ago. I've also tried to contact the various CERT but
they refused to handle the case or did not reply to my requests.
BR,
--
Eric Leblond
Blog: http://home.regit.org/
Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
