Re: Update: Extending the FTP "ALG" vulnerability to any FTP client

[paul () MOQUIJO COM (Paul Cardon)]

Lars.Troen () MERKANTILDATA NO wrote:
> With Firewall-1 all ports defined in the /etc/services file will be denied
> connections to during an ftp session. This is defined in the file base.def
> as follows:
> // ports which are dangerous to connect to
> #define NOTSERVER_TCP_PORT(p) {
>       (not
>           (
>              ( p in tcp_services, set sr10 RCODE_TCP_SERV, set sr11 0,
>               set sr12 p, set sr1 0, log bad_conn)

Actually, the /etc/services file has nothing to do with it.  All
services of type TCP _defined_within_FW-1_ are added to the tcp_services
table used in the macro listed above.  A default FW-1 install will
include a certain number of these but the list changes with the addition
or removal of TCP service definitions in the rule base.  The behavior of
the inspect code can also be modified to make it as strict or open as
desired.

-paul