Re: CP FW-1 next generation: TCP Packet out of state

Article View: comp.security.firewalls

Article #433

Back to comp.security.firewalls Previous Next

#433

From: Wayne McGlinn
Date: Sun, 07 Oct 2001 04:51

16 lines
1648 bytes

"Neil Desai" <ndesai01@tampabay.rr.com> wrote in message
news:tbYpWUrTBHA.254@dogwood.us.checkpoint.com...
> You might want to increase the TCP timeout or change the parameters to
allow
> non SYN packets to create and entry in the state table.
> Neil
<snip>

NO.  There are well known vulnerabilities that are then opened.  Check
http://www.enteract.com/lspitz and read Lance's explanation of the state
table before even considering allowing non SYN packets to create an entry in
the state table.

Wayne McGlinn
Brisbane, Oz

Technical Details

Message-ID: <$l8scruTBHA.118@dogwood.us.checkpoint.com>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!newsfeeds.belnet.be!news.belnet.be!news.tele.dk!small.news.tele.dk!128.39.3.168!uninett.no!news.ost.eltele.no!dogwood.us.checkpoint.com

References: <1002308196.894052@bfl-ea1> <tbYpWUrTBHA.254@dogwood.us.checkpoint.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,8f938ab63db9f2d7
X-Google-Attributes: gidf922c,public
X-Google-Thread: fc559,8f938ab63db9f2d7
X-Google-Attributes: gidfc559,public
X-Google-ArrivalTime: 2001-10-06 22:00:06 PST
Reply-To: "Wayne McGlinn" <wayne.mcglinn@didata.com.au>
From: "Wayne McGlinn" <wayne.mcglinn@didata.com.au>
References: <1002308196.894052@bfl-ea1> <tbYpWUrTBHA.254@dogwood.us.checkpoint.com>
Subject: Re: CP FW-1 next generation: TCP Packet out of state
Date: Sun, 7 Oct 2001 14:51:19 +1000
Lines: 18
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2462.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2462.0000
Message-ID: <$l8scruTBHA.118@dogwood.us.checkpoint.com>
Newsgroups: comp.security.firewalls,cp.products.firewall-1
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!newsfeeds.belnet.be!news.belnet.be!news.tele.dk!small.news.tele.dk!128.39.3.168!uninett.no!news.ost.eltele.no!dogwood.us.checkpoint.com
NNTP-Posting-Host: co3036476-a.fitzg1.qld.optushome.com.au 203.164.201.158

Reply to Parent Message