Skip to Content.
Sympa Menu

sm-security - [SM-Security] shorewall: security policy bypass

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas Houssin <thomas.houssin AT gmail.com>
  • To: sm-security <sm-security AT lists.ibiblio.org>
  • Subject: [SM-Security] shorewall: security policy bypass
  • Date: Sat, 01 Oct 2005 19:00:34 +0200

Synopsis
========
A vulnerability in Shorewall allows clients authenticated by MAC
address filtering to bypass all other security rules.

Background
==========
Shorewall is an iptables based firewall that can be used on a dedicated
firewall system, a multi-function gateway/router/server or on a
standalone Linux system.

Description
===========
CAN-2005-2317:
Shorewall 2.4.x before 2.4.2, when MACLIST_TTL is greater than 0 or
MACLIST_DISPOSITION is set to ACCEPT, allows remote attackers with an
accepted MAC address to bypass other firewall rules or policies.

Impact
======
A client authenticated by MAC address filtering could bypass all
security policies, possibly allowing him to gain access to restricted
services.

Workaround
==========
Set "MACLIST_TTL" to "0" and "MACLIST_DISPOSITION" to "REJECT" in the
shorewall configuration file.

Affected packages
=================
This is now fixed in devel, test, stable-rc/0.2 and stable/0.1 grimoires.

Resolution
==========
All shorewall users should upgrade to the latest available version:
# scribe update
# cast -c shorewall

References
==========
[ 1 ] CAN-2005-2317
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2317
[ 2 ] GLSA 200507-20
http://security.gentoo.org/glsa/glsa-200507-20.xml

--
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature



  • [SM-Security] shorewall: security policy bypass, Thomas Houssin, 10/01/2005

Archive powered by MHonArc 2.6.24.

Top of Page