FreeBSD ipfw Packet Lookup Error May Let Packets Bypass the Firewall
|
|
SecurityTracker Alert ID: 1014336
|
|
SecurityTracker URL: http://securitytracker.com/id?1014336
|
|
CVE Reference: CAN-2005-2019
(Links to External Site)
|
Date: Jun 29 2005
|
Impact: Host/resource access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: FreeBSD Security Advisory
|
Description: A vulnerability was reported in FreeBSD's ipfw packet filtering code. A remote user may be able to send a packet through the firewall.
On Symmetric Multi-Processor (SMP) systems and on Uni Processor (UP) systems with the PREEMPTION kernel option enabled, a packet
may be incorrectly matched against a lookup table. This may allow a packet to pass through when the packet should be blocked.
The
flaw is due to insufficient locking on table lookups, which may cause a cached lookup result to be corrupted.
|
Impact: A packet may be able to bypass the firewall without authorization.
|
Solution: The vendor has issued a fix and has provided the following instructions [quoted].
Perform one of the following:
1) Upgrade
your vulnerable system to 5-STABLE, or to the RELENG_5_4 security branch dated after the correction date.
2) To patch your present
system:
The following patches have been verified to apply to FreeBSD 5.4 systems.
a) Download the relevant patch from the
location below, and verify the detached PGP signature using your PGP utility.
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:13/ipfw.patch
#
fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:13/ipfw.patch.asc
b) Apply the patch.
# cd /usr/src
# patch <
/path/to/patch
c) Recompile your kernel as described in <URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
system.
|
Vendor URL: www.freebsd.org/ (Links to External Site)
|
Cause: Access control error
|
Underlying OS: UNIX (FreeBSD)
|
Underlying OS Comments: 5.4
|
Reported By: FreeBSD Security Advisories <security-advisories@freebsd.org>
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 29 Jun 2005 21:54:53 +0000 (GMT)
From: FreeBSD Security Advisories <security-advisories@freebsd.org>
Subject: FreeBSD Security Advisory FreeBSD-SA-05:13.ipfw
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=============================================================================
FreeBSD-SA-05:13.ipfw Security Advisory
The FreeBSD Project
Topic: ipfw packet matching errors with address tables
Category: core
Module: netinet
Announced: 2005-06-29
Credits: Max Laier
Affects: FreeBSD 5.4-RELEASE
Corrected: 2005-06-29 21:38:48 UTC (RELENG_5, 5.4-STABLE)
2005-06-29 21:41:03 UTC (RELENG_5_4, 5.4-RELEASE-p3)
CVE Name: CAN-2005-2019
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
<URL:http://www.freebsd.org/security/>.
I. Background
ipfw(8) is a system facility which allows IP packet filtering,
redirecting, and traffic accounting. ipfw lookup tables are a way to
specify many IP addresses which can be used for packet matching in an
efficient manner.
II. Problem Description
The ipfw tables lookup code caches the result of the last query. The
kernel may process multiple packets concurrently, performing several
concurrent table lookups. Due to an insufficient locking, a cached
result can become corrupted that could cause some addresses to be
incorrectly matched against a lookup table.
III. Impact
When lookup tables are used with ipfw, packets may on very rare
occasions incorrectly match a lookup table. This could result in a
packet being treated contrary to the defined packet filtering ruleset.
For example, a packet may be allowed to pass through when it should
have been discarded.
The problem can only occur on Symmetric Multi-Processor (SMP) systems,
or on Uni Processor (UP) systems with the PREEMPTION kernel option
enabled (not the default).
IV. Workaround
a) Do not use lookup tables.
OR
b) Disable concurrent processing of packets in the network stack by
setting the "debug.mpsafenet=0" tunable:
# echo "debug.mpsafenet=0" >> /boot/loader.conf
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to 5-STABLE, or to the RELENG_5_4
security branch dated after the correction date.
2) To patch your present system:
The following patches have been verified to apply to FreeBSD 5.4
systems.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:13/ipfw.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:13/ipfw.patch.asc
b) Apply the patch.
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the revision numbers of each file that was
corrected in FreeBSD.
Branch Revision
Path
- -------------------------------------------------------------------------
RELENG_5
src/sys/netinet/ip_fw2.c 1.70.2.14
RELENG_5_4
src/UPDATING 1.342.2.24.2.12
src/sys/conf/newvers.sh 1.62.2.18.2.8
src/sys/netinet/ip_fw2.c 1.70.2.10.2.1
- -------------------------------------------------------------------------
VII. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2019
The latest revision of this advisory is available at
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:13.ipfw.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (FreeBSD)
iD8DBQFCwxeeFdaIBMps37IRAkOAAJ0cCLsoqdUsfTfPNxocl1/TSORXnwCeIq0L
wM2hw6x90lSyoEVYnxfAg2s=
=khtV
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
|
|
