Re: Crafted Packets Handling by Firewalls - FW-1 case

[avalon () COOMBS ANU EDU AU (Darren Reed)]

In some mail from Ofir Arkin, sie said:
> I will try to focus more on the subject.
>
> FW-1 do accept:  ACK, SYN-ACK, NULL, FIN-ACK  (and more) as valid
> traffic if they match the rule base, even if no connection establishment
> was in progress and no session state was in the firewalls table.
[...]

FW-1's behaviour in this respect has been discussed at length in the
past and last year a patch was released by them for their base INSPECT
code which changed the behaviour to not be this way.  A patch, which
fixes this problem, was made available due to DoS problems.  I believe
this URL will help you:

http://www.checkpoint.com/techsupport/alerts/ackdos.html

Darren