ERRATA: [ GLSA 200507-20 ] Shorewall: Security policy bypass

From: Thierry Carrez (koon_at_gentoo.org)
Date: 09/17/05

  • Next message: Gadi Evron: "router worms and International Infrastructure [was: Re: IOS exploit]" 
    Date: Sat, 17 Sep 2005 14:31:52 +0200
To: gentoo-announce@lists.gentoo.org

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory [ERRATA UPDATE] GLSA 200507-20:02
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                                http://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

      Severity: Low
         Title: Shorewall: Security policy bypass
          Date: July 22, 2005
       Updated: September 14, 2005
          Bugs: #99398
            ID: 200507-20:02

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Errata
    ======

    The "unaffected" version was incorrectly set to 2.4.1 in the initial
    advisory, the correct "unaffected" version is 2.4.2.

    The corrected sections appear below.

    Synopsis
    ========

    A vulnerability in Shorewall allows clients authenticated by MAC
    address filtering to bypass all other security rules.

    Background
    ==========

    Shorewall is a high level tool for configuring Netfilter, the firewall
    facility included in the Linux Kernel.

    Affected packages
    =================

        -------------------------------------------------------------------
         Package / Vulnerable / Unaffected
        -------------------------------------------------------------------
      1 net-firewall/shorewall <= 2.4.1 >= 2.4.2

    Description
    ===========

    Shorewall fails to enforce security policies if configured with
    "MACLIST_DISPOSITION" set to "ACCEPT" or "MACLIST_TTL" set to a value
    greater or equal to 0.

    Impact
    ======

    A client authenticated by MAC address filtering could bypass all
    security policies, possibly allowing him to gain access to restricted
    services. The default installation has MACLIST_DISPOSITION=REJECT and
    MACLIST_TTL=(blank) (equivalent to 0). This can be checked by looking
    at the settings in /etc/shorewall/shorewall.conf

    Workaround
    ==========

    Set "MACLIST_TTL" to "0" and "MACLIST_DISPOSITION" to "REJECT" in the
    Shorewall configuration file (usually /etc/shorewall/shorewall.conf).

    Resolution
    ==========

    All Shorewall users should upgrade to the latest available version:

        # emerge --sync
        # emerge --ask --oneshot --verbose net-firewall/shorewall

    References
    ==========

      [ 1 ] CAN-2005-2317
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2317
      [ 2 ] Shorewall Announcement
            http://www.shorewall.net/News.htm#20050717

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

      http://security.gentoo.org/glsa/glsa-200507-20.xml

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users machines is of utmost
    importance to us. Any security concerns should be addressed to
    security@gentoo.org or alternatively, you may file a bug at
    http://bugs.gentoo.org.

    License
    =======

    Copyright 2005 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    http://creativecommons.org/licenses/by-sa/2.0

  • Next message: Gadi Evron: "router worms and International Infrastructure [was: Re: IOS exploit]"

    Relevant Pages