3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
133 lines
5 KiB
Text
133 lines
5 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-01:08 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: ipfw/ip6fw allows bypassing of 'established' keyword
|
|
|
|
Category: core
|
|
Module: kernel
|
|
Announced: 2001-01-23
|
|
Credits: Aragon Gouveia <aragon@phat.za.net>
|
|
Affects: FreeBSD 3.x (all releases), FreeBSD 4.x (all releases),
|
|
FreeBSD 3.5-STABLE and 4.2-STABLE prior to the
|
|
correction date.
|
|
Corrected: 2001-01-09 (FreeBSD 4.2-STABLE)
|
|
2001-01-12 (FreeBSD 3.5-STABLE)
|
|
FreeBSD only: Yes
|
|
|
|
I. Background
|
|
|
|
ipfw is a system facility which allows IP packet filtering,
|
|
redirecting, and traffic accounting. ip6fw is the corresponding
|
|
utility for IPv6 networks, included in FreeBSD 4.0 and above. It is
|
|
based on an old version of ipfw and does not contain as many features.
|
|
|
|
II. Problem Description
|
|
|
|
Due to overloading of the TCP reserved flags field, ipfw and ip6fw
|
|
incorrectly treat all TCP packets with the ECE flag set as being part
|
|
of an established TCP connection, which will therefore match a
|
|
corresponding ipfw rule containing the 'established' qualifier, even
|
|
if the packet is not part of an established connection.
|
|
|
|
The ECE flag is not believed to be in common use on the Internet at
|
|
present, but is part of an experimental extension to TCP for
|
|
congestion notification. At least one other major operating system
|
|
will emit TCP packets with the ECE flag set under certain operating
|
|
conditions.
|
|
|
|
Only systems which have enabled ipfw or ip6fw and use a ruleset
|
|
containing TCP rules which make use of the 'established' qualifier,
|
|
such as "allow tcp from any to any established", are vulnerable. The
|
|
exact impact of the vulnerability on such systems is undetermined and
|
|
depends on the exact ruleset in use.
|
|
|
|
All released versions of FreeBSD prior to the correction date
|
|
including FreeBSD 3.5.1 and FreeBSD 4.2 are vulnerable, but it was
|
|
corrected prior to the (future) release of FreeBSD 4.3.
|
|
|
|
III. Impact
|
|
|
|
Remote attackers who construct TCP packets with the ECE flag set may
|
|
bypass certain ipfw rules, allowing them to potentially circumvent
|
|
the firewall.
|
|
|
|
IV. Workaround
|
|
|
|
Because the vulnerability only affects 'established' rules and ECE-
|
|
flagged TCP packets, this vulnerability can be removed by adjusting
|
|
the system's rulesets. In general, it is possible to express most
|
|
'established' rules in terms of a general TCP rule (with no TCP flag
|
|
qualifications) and a 'setup' rule, but may require some restructuring
|
|
and renumbering of the ruleset.
|
|
|
|
V. Solution
|
|
|
|
One of the following:
|
|
|
|
1) Upgrade the vulnerable FreeBSD system to FreeBSD 3.5-STABLE, or
|
|
or 4.2-STABLE after the correction date.
|
|
|
|
2) Patch your present system by downloading the relevant patch from the
|
|
below location:
|
|
|
|
[FreeBSD 4.x]
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:08/ipfw-4.x.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:08/ipfw-4.x.patch.asc
|
|
|
|
[FreeBSD 3.x]
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:08/ipfw-3.x.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:08/ipfw-3.x.patch.asc
|
|
|
|
Verify the detached PGP signature using your PGP utility.
|
|
|
|
Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch -p < /path/to/patch
|
|
# cp /usr/src/sys/netinet/tcp.h /usr/src/sys/netinet/ip_fw.h /usr/include/netinet/
|
|
# cd /usr/src/sbin/ipfw
|
|
# make depend && make all install
|
|
# cd /usr/src/sys/modules/ipfw
|
|
# make depend && make all install
|
|
|
|
For 4.x systems, perform the following additional steps:
|
|
|
|
# cp /usr/src/sys/netinet6/ip6_fw.h /usr/include/netinet6/
|
|
# cd /usr/src/sbin/ip6fw
|
|
# make depend && make all install
|
|
# cd /usr/src/sys/modules/ip6fw
|
|
# make depend && make all install
|
|
|
|
NOTE: The ip6fw patches have not yet been tested but are believed to
|
|
be correct. The ip6fw software is not currently maintained and may be
|
|
removed in a future release.
|
|
|
|
If the system is using the ipfw or ip6fw kernel modules (see
|
|
kldstat(8)), the module may be unloaded and the corrected module
|
|
loaded into the kernel using kldload(8)/kldunload(8). This will
|
|
require that the firewall rules be reloaded, usually be executing the
|
|
/etc/rc.firewall script. Because the loading of the ipfw or ip6fw
|
|
module will result in the system denying all packets by default, this
|
|
should only be attempted when accessing the system via console or by
|
|
careful use of a command such as:
|
|
|
|
# kldload ipfw && sh /etc/rc.firewall
|
|
|
|
which performs both operations sequentially.
|
|
|
|
Otherwise, if the system has ipfw or ip6fw compiled into the kernel,
|
|
the kernel will also have to be recompiled and installed, and the
|
|
system will have to be rebooted for the changes to take effect.
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.4 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBOm3yulUuHi5z0oilAQEJbQP+Nf6JEKNUz0bOhgOYmY0DDCQNbY/2dlxA
|
|
Qhs59HSB9Y7cwP+NuFKhix2fii8Y5oSOxjfMhllRl0yIQMHloG6orXNBuYJQ++d5
|
|
A/e+eoePNTzTo7kbaEZyvS3pGBodkueUmnKAqT9Ho/SGY00p4/JxpNcp3KuYT4Re
|
|
gyKXSFV3rkQ=
|
|
=7XOn
|
|
-----END PGP SIGNATURE-----
|