Full Disclosure mailing list archives
Re: DNS and Checkpoint
From: "Sandro Gauci" <sandro () enablesecurity com>
Date: Thu, 10 Jul 2008 10:07:28 +0200
The question is - is this feature (src port randomization) enabled by default? On Thu, Jul 10, 2008 at 9:00 AM, Deniz Cevik <Deniz.Cevik () intellect com tr> wrote:
Yes, enable this feature at see what will happen. This check sometimes drop valid dns request. ------------------------------ *From:* full-disclosure-bounces () lists grok org uk [mailto: full-disclosure-bounces () lists grok org uk] *On Behalf Of *Ray P *Sent:* Thursday, July 10, 2008 4:35 AM *To:* imipak; Full Disclosure *Subject:* Re: [Full-disclosure] DNS and Checkpoint The article you're looking at is for their SmartDefense product, an add-in to Firewall-1. Supposedly it will protect a DNS server behind the firewall from this vulnerability. RayDate: Wed, 9 Jul 2008 15:00:39 +0100 From: imipak () gmail com To: full-disclosure () lists grok org uk Subject: [Full-disclosure] DNS and Checkpoint Hello everyone, I've had a report from someone with clue (and tcpdump) that a properly functioning DNS resolver that correctly uses randomised source ports magically becomes vulnerable once the traffic's passed through a Checkpoint firewall, where Dan Kaminsky's tool shows: x.y.z.155:56978 TXID=712 x.y.z.155:56979 TXID=45713 x.y.z.155:56980 TXID=63532 x.y.z.155:56981 TXID=7243 x.y.z.155:56982 TXID=17620 (note the incrementing port numbers.) Can anyone else confirm this behaviour? Checkpoint are one of the dozens of vendors listed on the CERT advisory as "Status: Unknown" http://www.kb.cert.org/vuls/id/MIMG-7ECL6B They do have an advisory up:http://www.checkpoint.com/defense/advisories/public/2008/cpai-01-Jul.htmlI don't have the login needed to read the whole thing, but the front page just says: "Protection provided by: VPN-1: * NGX R65 * NGX R62 * NGX R61 * NGX R60 [...etc, etc...] " cheers =i _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/------------------------------ Need to know now? Get instant answers with Windows Live Messenger. IM on your terms.<http://www.windowslive.com/messenger/connect_your_way.html?ocid=TXT_TAGLM_WL_messenger_072008> _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- DNS and Checkpoint imipak (Jul 09)
- Re: DNS and Checkpoint Ray P (Jul 09)
- Re: DNS and Checkpoint Deniz Cevik (Jul 10)
- Re: DNS and Checkpoint Sandro Gauci (Jul 10)
- Re: DNS and Checkpoint Deniz Cevik (Jul 10)
- <Possible follow-ups>
- Re: DNS and Checkpoint Rodrigo Rubira Branco (BSDaemon) (Jul 09)
- Re: DNS and Checkpoint Ray P (Jul 09)