[29519] in bugtraq
Re: Check Point FW-1: attack against syslog daemon possible
daemon@ATHENA.MIT.EDU (Dr. Peter Bieringer)
Thu Mar 27 20:11:56 2003
Date: Thu, 27 Mar 2003 11:59:49 +0100
From: "Dr. Peter Bieringer" <pbieringer@aerasec.de>
To: Maillist Bugtraq <bugtraq@securityfocus.com>
Message-ID: <8442850.1048766389@[10.3.62.6]>
In-Reply-To: <36220782.1048708521@[10.3.62.6]>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1; format=flowed
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Hi again,
now we are finished the investigation of FW-1 4.1 (SP6) with following
result:
In our lab the syslog daemon of Check Point FW-1 4.1 didn't crash in case
of sending "/dev/urandom" via "nc", but this floods the log without any
rate limiting.
Also the syslog messages were not filtered.
Note also that that improving the ruleset didn't help in cases where
trusted and untrusted nodes are sharing the same network, because in UDP
packets the sender IP address can be spoofed (successfully tested with
"sendip" against FW-1 4.1).
To avoid spoofing, only MAC based ACLs on gateways (if available) will help
or establishing a dedicated (V)LAN for trusted sources only.
We've updated our advisory once again:
http://www.aerasec.de/security/advisories/txt/
checkpoint-fw1-ng-fp3-syslog-crash.txt
http://www.aerasec.de/security/advisories/
checkpoint-fw1-ng-fp3-syslog-crash.html
Hope this helps,
Peter
--
Dr. Peter Bieringer Phone: +49-8102-895190
AERAsec Network Services and Security GmbH Fax: +49-8102-895199
Wagenberger Straße 1 Mobile: +49-174-9015046
D-85662 Hohenbrunn E-Mail: pbieringer@aerasec.de
Germany Internet: http://www.aerasec.de
