Linux 2.4 Kernel MAC Module Filtering Bypassing Vulnerability
BID:3418
Info
Linux 2.4 Kernel MAC Module Filtering Bypassing Vulnerability
| Bugtraq ID: | 3418 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 10 2001 12:00AM |
| Updated: | Oct 10 2001 12:00AM |
| Credit: | This vulnerability was announced by Chris Wilson <[email protected]> to Bugtraq on October 10, 2001. |
| Vulnerable: |
Linux kernel 2.4.11 Linux kernel 2.4.10 Linux kernel 2.4.9 Linux kernel 2.4.8 Linux kernel 2.4.7 Linux kernel 2.4.6 Linux kernel 2.4.5 Linux kernel 2.4.4 Linux kernel 2.4.3 Linux kernel 2.4.2 Linux kernel 2.4.1 Linux kernel 2.4 |
| Not Vulnerable: | |
Discussion
Linux 2.4 Kernel MAC Module Filtering Bypassing Vulnerability
The Linux Kernel is the core of all Linux-based operating systems. It is maintained by public domain, and steered by Linus Torvalds.
A problem in the Netfilter functions of the Linux Kernel could allow a remote user intended access to sensitive systems. By sending fragmented packets to a system that filters on the basis of MAC address, it is possible to bypass filtering.
This could lead to user on a local segment of network gaining unintended access to services on a target system.
The Linux Kernel is the core of all Linux-based operating systems. It is maintained by public domain, and steered by Linus Torvalds.
A problem in the Netfilter functions of the Linux Kernel could allow a remote user intended access to sensitive systems. By sending fragmented packets to a system that filters on the basis of MAC address, it is possible to bypass filtering.
This could lead to user on a local segment of network gaining unintended access to services on a target system.
Solution / Fix
Linux 2.4 Kernel MAC Module Filtering Bypassing Vulnerability
Solution:
This fix has been provided by Harald Welte, the Netfilter maintainer:
--- linux-2.4.9/net/ipv4/netfilter/ipt_mac.c Tue Oct 2 18:50:56 2001
+++ linux-2.4.9-ipt_mac-fix/net/ipv4/netfilter/ipt_mac.c Tue Oct 2 19:32:20 2001
@@ -20,7 +20,7 @@
/* Is mac pointer valid? */
return (skb->mac.raw >= skb->head
- && skb->mac.raw < skb->head + skb->len - ETH_HLEN
+ && (skb->mac.raw + ETH_HLEN) <= skb->data
/* If so, compare... */
&& ((memcmp(skb->mac.ethernet->h_source, info->srcaddr, ETH_ALEN)
== 0) ^ info->invert));
Solution:
This fix has been provided by Harald Welte, the Netfilter maintainer:
--- linux-2.4.9/net/ipv4/netfilter/ipt_mac.c Tue Oct 2 18:50:56 2001
+++ linux-2.4.9-ipt_mac-fix/net/ipv4/netfilter/ipt_mac.c Tue Oct 2 19:32:20 2001
@@ -20,7 +20,7 @@
/* Is mac pointer valid? */
return (skb->mac.raw >= skb->head
- && skb->mac.raw < skb->head + skb->len - ETH_HLEN
+ && (skb->mac.raw + ETH_HLEN) <= skb->data
/* If so, compare... */
&& ((memcmp(skb->mac.ethernet->h_source, info->srcaddr, ETH_ALEN)
== 0) ^ info->invert));