FreeBSD IPFW Address Table Lookup Atomicity Error Firewall Rule Bypass Vulnerability
BID:14102
Info
FreeBSD IPFW Address Table Lookup Atomicity Error Firewall Rule Bypass Vulnerability
| Bugtraq ID: | 14102 |
| Class: | Atomicity Error |
| CVE: |
CVE-2005-2019 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 29 2005 12:00AM |
| Updated: | Jul 12 2009 04:06PM |
| Credit: | Discovery of this issue is credited to Max Laier. |
| Vulnerable: |
FreeBSD FreeBSD 5.4 -RELEASE |
| Not Vulnerable: | |
Discussion
FreeBSD IPFW Address Table Lookup Atomicity Error Firewall Rule Bypass Vulnerability
FreeBSD IPFW is prone to an atomicity error that might result in erroneous lookup table matching under certain circumstances. Reports indicate the issue exists on SMP (Symmetric Multi-Processor) based platforms, or on UP (Uni Processor) platforms that have a system kernel configured with 'PREEMPTION' functionality enabled. (Note: This is not a default configuration).
This issue may be leveraged to aid in attacks launched against target computers that are protected by the affected firewall.
FreeBSD IPFW is prone to an atomicity error that might result in erroneous lookup table matching under certain circumstances. Reports indicate the issue exists on SMP (Symmetric Multi-Processor) based platforms, or on UP (Uni Processor) platforms that have a system kernel configured with 'PREEMPTION' functionality enabled. (Note: This is not a default configuration).
This issue may be leveraged to aid in attacks launched against target computers that are protected by the affected firewall.
Exploit / POC
FreeBSD IPFW Address Table Lookup Atomicity Error Firewall Rule Bypass Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
FreeBSD IPFW Address Table Lookup Atomicity Error Firewall Rule Bypass Vulnerability
Solution:
The vendor has released an advisory (FreeBSD-SA-05:13.ipfw) and fixes to address this issue.
FreeBSD FreeBSD 5.4 -RELEASE
Solution:
The vendor has released an advisory (FreeBSD-SA-05:13.ipfw) and fixes to address this issue.
FreeBSD FreeBSD 5.4 -RELEASE
-
FreeBSD ipfw.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:13/ipfw.patch
References
FreeBSD IPFW Address Table Lookup Atomicity Error Firewall Rule Bypass Vulnerability
References:
References: