oss-sec mailing list archives
Re: Attack on badly configured Netfilter-based firewalls
From: Eric Leblond <eric () regit org>
Date: Tue, 28 Feb 2012 10:46:58 +0100
Hello, On Mon, 2012-02-27 at 19:13 +0100, Florian Weimer wrote:
* Eric Leblond:I've discovered a generic attack on firewall using Application Level Gateway (like Netfilter or Checkpoint).This is rediscovered every two to five years. Here's mine (from 2005, but it's been proposed before): <http://www.enyo.de/fw/security/java-firewall/>Secure use of iptables and connection tracking helpers: http://home.regit.org/netfilter-en/secure-use-of-helpers/I think your filters aren't effective against sandboxed Java code on the client.
Interesting point. On this abnormal usage of helper, I fear more "malicious" software. I'm even surprised that a wonderful network evasion software like Shype is not using this technique.
I think there are other client-side sandboxes which allow de-facto unrestricted access (with server cooperation). Doesn't Flash require just a policy file on the server to open up arbitrary ports? You could exclude the magic Silverlight port range: | One additional restriction on using the sockets classes is that the | destination port range that a network application is allowed to | connect to must be within the range of 4502-4534. <http://msdn.microsoft.com/en-us/library/cc645032%28v=vs.95%29.aspx>
Regarding Netfilter, the FTP helper will only do the analysis if you connect to port 21 (or to match params specified by CT target). There is no need to limit traffic on other ports. Thus, it seems the approach explained in Netfilter document is correct: only activate the helpers to trusted server (if you can) or accept the fact that abnormal usage can be done. Regarding this last point, I will update the document to be more precise about the potential attack and evasion. Best regards, -- Eric Leblond Blog: http://home.regit.org/
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Re: Attack on badly configured Netfilter-based firewalls, (continued)
- Re: Attack on badly configured Netfilter-based firewalls Kurt Seifried (Feb 26)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Feb 26)
- Re: Attack on badly configured Netfilter-based firewalls Solar Designer (Feb 26)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Feb 26)
- Re: Attack on badly configured Netfilter-based firewalls yersinia (Feb 27)
- Re: Attack on badly configured Netfilter-based firewalls Sebastian Krahmer (Feb 27)
- Re: Attack on badly configured Netfilter-based firewalls ArkanoiD (Feb 27)
- Re: Attack on badly configured Netfilter-based firewalls Sebastian Krahmer (Feb 27)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Feb 26)
- Re: Attack on badly configured Netfilter-based firewalls Kurt Seifried (Feb 26)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Feb 27)
- Re: Attack on badly configured Netfilter-based firewalls Eric Leblond (Feb 28)