Re: CP FW-1 next generation: TCP Packet out of state

Article View: comp.security.firewalls

Article #427

Back to comp.security.firewalls Previous Next

#427

From: Neil Desai
Date: Mon, 08 Oct 2001 03:43

32 lines
2274 bytes

To expose the vulnerabilities that are on Lance's site you would have to
have the following things:
1. A rule to allow the traffic.
2. The hosts that are in the above rule would have to be down.

What is going to happen is that a NON SYN packet will go through the
rulebase and if it makes a match then it will go into the state table. If it
does not make a match in the rulebase then it will not be entered in the
state table.
Neil

"Wayne McGlinn" <wayne.mcglinn@didata.com.au> wrote in message
news:$l8scruTBHA.118@dogwood.us.checkpoint.com...
>
> "Neil Desai" <ndesai01@tampabay.rr.com> wrote in message
> news:tbYpWUrTBHA.254@dogwood.us.checkpoint.com...
> > You might want to increase the TCP timeout or change the parameters to
> allow
> > non SYN packets to create and entry in the state table.
> > Neil
> <snip>
>
> NO.  There are well known vulnerabilities that are then opened.  Check
> http://www.enteract.com/lspitz and read Lance's explanation of the state
> table before even considering allowing non SYN packets to create an entry
in
> the state table.
>
> Wayne McGlinn
> Brisbane, Oz
>
>

Technical Details

Message-ID: <3UHIMr6TBHA.114@dogwood.us.checkpoint.com>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsfeed.mathworks.com!news.mathworks.com!uunet!nyc.uu.net!news.hks.com!dogwood.us.checkpoint.com

References: <1002308196.894052@bfl-ea1> <tbYpWUrTBHA.254@dogwood.us.checkpoint.com> <$l8scruTBHA.118@dogwood.us.checkpoint.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,8f938ab63db9f2d7
X-Google-Attributes: gidf922c,public
X-Google-Thread: fc559,8f938ab63db9f2d7
X-Google-Attributes: gidfc559,public
X-Google-ArrivalTime: 2001-10-07 20:45:24 PST
Reply-To: "Neil Desai" <ndesai01@tampabay.rr.com>
From: "Neil Desai" <ndesai01@tampabay.rr.com>
References: <1002308196.894052@bfl-ea1> <tbYpWUrTBHA.254@dogwood.us.checkpoint.com> <$l8scruTBHA.118@dogwood.us.checkpoint.com>
Subject: Re: CP FW-1 next generation: TCP Packet out of state
Date: Sun, 7 Oct 2001 23:43:54 -0400
Lines: 34
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 5.50.4133.2400
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400
Message-ID: <3UHIMr6TBHA.114@dogwood.us.checkpoint.com>
Newsgroups: comp.security.firewalls,cp.products.firewall-1
NNTP-Posting-Host: 6532110hfc176.tampabay.rr.com 65.32.110.176
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsfeed.mathworks.com!news.mathworks.com!uunet!nyc.uu.net!news.hks.com!dogwood.us.checkpoint.com

Reply to Parent Message