Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: Attack on badly configured Netfilter-based firewalls
From: Yves-Alexis Perez <corsac () debian org>
Date: Sat, 25 Feb 2012 21:10:36 +0100

On sam., 2012-02-25 at 19:37 +0100, Eric Leblond wrote:
Impact:
An attacker on a local network can open some pinholes in a firewall
which is not correctly protected.
Fix:
None, the issue has to be fixed in the firewall configuration.
Workaround:
Apply a strict anti-spoofing policy for IPv4 and IPv6 as described in
the document "Secure use of iptables and connection tracking helpers" 
This document was written after private disclosure of the attack to the
Netfilter's team.


Did you check how the various frontends to iptables (ferm, ufw,
shorewall and the gazillon others)? They might generate an “insecure”
ruleset and might be candidate to a fix.

Regards,
-- 
Yves-Alexis

Attachment: signature.asc
Description: This is a digitally signed message part


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]