[26832] in bugtraq
Re: IPv4 mapped address considered harmful
daemon@ATHENA.MIT.EDU (Anthony DeRobertis)
Tue Aug 27 15:00:44 2002
From: Anthony DeRobertis <asd@suespammers.org>
To: itojun@iijlab.net
In-Reply-To: <20020827043212.5A21E4B23@coconut.itojun.org>
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature";
boundary="=-8U3x9892LPvbBbLS4ZNL"
Date: 27 Aug 2002 01:48:51 -0400
Message-Id: <1030427331.12407.13.camel@bohr>
Mime-Version: 1.0
--=-8U3x9892LPvbBbLS4ZNL
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
> the key difference is that it may be possible to circumvent IPv4
> filters by using IPv4 mapped address (=3D IPv6 address like
> ::ffff:1.2.3.4). the problem is in additional complexity due to
> the interaction between IPv4 packet and IPv6 API/packet.
I'll give you that there is some additional complexity, but I don't
think that addresses in ::ffff:0:0/96 should cause too much trouble,
because they were previously bogons.=20
In general, when ever a new protocol is enabled on a network, firewalls,
IDSs, and other security devices need to be upgraded (or reconfigured)
to support it.
Maybe I'm missing something, but I don't see whats so different about
using mapped IPv4 addresses on the wire, especially since your bogon
filters should already be dropping any use.
--=-8U3x9892LPvbBbLS4ZNL
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQA9axLD+z+IwlXqWf4RAm+ZAJ49lRhzPbMH4Qnlvo2D6IY/ux1MywCfQEux
fmTlih8e2T3U2db2UPWCC+o=
=VGgj
-----END PGP SIGNATURE-----
--=-8U3x9892LPvbBbLS4ZNL--
