Re: Sony: No firewall and no patches

["Dobbins, Roland" <rdobbins () arbor net>]

On May 10, 2011, at 4:42 PM, Pete Smith wrote:

>  if an attacker initiates a connection dest port higher than 2048 (to some other server the attacker controls) and 
> source port of 80 that will pass through an ACL without issues, this would not be so on a stateful firewall.


If the attacker's in a position to generate an outbound connection sourced from a well-known port (which presumably is 
supposed to have an httpd attached to it), there's nothing a stateful firewall can do to improve matters.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins () arbor net> // <http://www.arbornetworks.com>

                The basis of optimism is sheer terror.

                          -- Oscar Wilde

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/