Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: Update: Extending the FTP "ALG" vulnerability to any FTP client
From: paul () MOQUIJO COM (Paul Cardon)
Date: Tue, 21 Mar 2000 11:00:18 -0500


Lars.Troen () MERKANTILDATA NO wrote:

With Firewall-1 all ports defined in the /etc/services file will be denied
connections to during an ftp session. This is defined in the file base.def
as follows:
// ports which are dangerous to connect to
#define NOTSERVER_TCP_PORT(p) {
      (not
          (
             ( p in tcp_services, set sr10 RCODE_TCP_SERV, set sr11 0,
              set sr12 p, set sr1 0, log bad_conn)

Actually, the /etc/services file has nothing to do with it.  All
services of type TCP _defined_within_FW-1_ are added to the tcp_services
table used in the macro listed above.  A default FW-1 install will
include a certain number of these but the list changes with the addition
or removal of TCP service definitions in the rule base.  The behavior of
the inspect code can also be modified to make it as strict or open as
desired.

-paul


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]