Skip to Content.
Sympa Menu

sm-grimoire-bugs - [SM-Grimoire-Bugs] [Bug 9470] New: shorewall MACLIST_TTL Vulnerability

sm-grimoire-bugs AT lists.ibiblio.org

Subject: SourceMage Grimoire Bug List

List archive

Chronological Thread  
  • From: bugzilla-daemon AT bugs.sourcemage.org
  • To: sm-grimoire-bugs AT lists.ibiblio.org
  • Subject: [SM-Grimoire-Bugs] [Bug 9470] New: shorewall MACLIST_TTL Vulnerability
  • Date: 31 Mar 2007 07:22:07 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=9470

Summary: shorewall MACLIST_TTL Vulnerability
Product: Codex
Version: stable grimoire
Platform: Other
OS/Version: other
Status: CLOSED
Severity: normal
Priority: P2
Component: net
AssignedTo: sm-grimoire-bugs AT lists.ibiblio.org
ReportedBy: Thomas.Houssin AT sourcemage.org


This affects shorewall both in test and stable grimoire :

CAN-2005-2317 :
Shorewall 2.4.x before 2.4.1, 2.2.x before 2.2.5, and 2.0.x before 2.0.17,
when
MACLIST_TTL is greater than 0 or MACLIST_DISPOSITION is set to ACCEPT, allows
remote attackers with an accepted MAC address to bypass other firewall rules
or
policies.


------- Additional Comments From v.merkatz AT gmx.net 2005-09-22 14:07 -------
So what do you intend to do? devel has shorewall 2.4.1 without a WIP, should
that be integrated down to stable?

--


------- Additional Comments From Thomas.Houssin AT sourcemage.org 2005-09-22
14:17 -------
In fact, there's a mistake in CAN-2005-2317, shorewall 2.4.1 is also affected.
I'll update it to 2.4.4 and integrate to test. The question is what about
stable
? Is there any reasons not to push 2.4.X to stable ?

--


------- Additional Comments From v.merkatz AT gmx.net 2005-09-22 14:28 -------
It can at least go to stable-rc, as that already has 2.4.0. I'm not a
shorewall
user myself, so not sure if there are compatibility issues between 2.2 and
2.4,
but other than that it should go to stable.

--


------- Additional Comments From Thomas.Houssin AT sourcemage.org 2005-09-22
14:42 -------
Same problem, I'm not a shorewall user. After a quick look on the website, I
didn't find any big issue when upgrading between 2.2 and 2.4 (only between 2.0
and 2.2).
Moreother, PREPARE is not executable in the grimoires. I don't think it's
normal. Anyway, it makes this code in DETAILS useless:

if [[ $USEVER == "2.0.x" ]] ; then
VERSION=2.0.16
SOURCE=$SPELL-$VERSION.tgz

SOURCE_URL[0]=http://slovakia.shorewall.net/pub/$SPELL/2.0/$SPELL-$VERSION/$SOURCE

SOURCE_URL[1]=http://www.shorewall.net/pub/$SPELL/2.0/$SPELL-$VERSION/$SOURCE

SOURCE_URL[2]=http://shorewall.infohiiway.com/pub/$SPELL/2.0/$SPELL-$VERSION/$SOURCE
MD5[0]=078eba4d5094d4af61ba9a2a23d12beb
else

It seems it's like this for a while, I guess since 2005-02-14; so everybody
use
at least 2.2 version. Can I assume that, and support only 2.4.x ?

--


------- Additional Comments From v.merkatz AT gmx.net 2005-09-22 14:48 -------
Go ahead and do that. We can always add it back if there's a good reason and
users complain.

--


------- Additional Comments From Thomas.Houssin AT sourcemage.org 2005-09-24
19:48 -------
Done in devel and test.

--


------- Additional Comments From eric AT sandall.us 2005-09-25 00:42 -------
Seems to work fine here: approved.

--


------- Additional Comments From Thomas.Houssin AT sourcemage.org 2005-09-25
17:44 -------
Integrated in stable-rc and stable.

--


------- Additional Comments From jblosser-smgl AT firinn.org 2007-03-31 01:22
-------
closing fixed bugs

--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.



  • [SM-Grimoire-Bugs] [Bug 9470] New: shorewall MACLIST_TTL Vulnerability, bugzilla-daemon, 03/31/2007

Archive powered by MHonArc 2.6.24.

Top of Page