Kame-Derived Stack Non-ESP IPV4 Forwarded Packets Policy Bypassing Vulnerability

Bugtraq ID:	4224
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 04 2002 12:00AM
Updated:	Mar 04 2002 12:00AM
Credit:	Vulnerability discovered and announced by Greg Troxel <[email protected]> and Bill Chiarchiaro <[email protected]>.
Vulnerable:	OpenBSD OpenBSD 2.7 OpenBSD OpenBSD 2.6 NetBSD NetBSD 1.5.2 NetBSD NetBSD 1.5.1 NetBSD NetBSD 1.5 FreeBSD FreeBSD 4.5 FreeBSD FreeBSD 4.4 FreeBSD FreeBSD 4.3 FreeBSD FreeBSD 4.2
Not Vulnerable:	OpenBSD OpenBSD 2.9 OpenBSD OpenBSD 2.8 OpenBSD OpenBSD 3.0

Kame-Derived Stack Non-ESP IPV4 Forwarded Packets Policy Bypassing Vulnerability

KAME is a freely available, open source IPv6 and IPSec implementation. It is distributed and maintained by the KAME Project.

Under some circumstances, KAME does not adhere to the RFC-specified protocol, and creates a situation that could have security implications. When an IPv4 network is using Encapsulating Security Payload (ESP) between a system and router endpoints with non-ESP traffic blocked at the Security Gateway (SG), non-ESP IPv4 traffic sent to the SG would be forwarded by the SG. This could allow an attacker with arbitrary access to the network to pass traffic out of the network via the SG. It should be noted that traffic through the SG for the arbitrary host would be blocked, as the router implementation handles this traffic type correctly.

Kame-Derived Stack Non-ESP IPV4 Forwarded Packets Policy Bypassing Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Kame-Derived Stack Non-ESP IPV4 Forwarded Packets Policy Bypassing Vulnerability

Solution:
The following patches have been provided in the advisory by Greg Troxel <[email protected]>:

For NetBSD netbsd-1-5:

Index: src/sys/netinet/ip_input.c
===================================================================
RCS file: /NETBSD-CVS/netbsd/src/sys/netinet/ip_input.c,v
retrieving revision 1.1.1.1
diff -u -r1.1.1.1 ip_input.c
--- src/sys/netinet/ip_input.c 2001/07/05 14:42:54 1.1.1.1
+++ src/sys/netinet/ip_input.c 2002/02/25 01:07:02
@@ -611,6 +611,15 @@
ipstat.ips_cantforward++;
m_freem(m);
} else {
+#ifdef IPSEC
+ /*
+ * Enforce inbound IPsec SPD.
+ */
+ if (ipsec4_in_reject(m, NULL)) {
+ ipsecstat.in_polvio++;
+ goto bad;
+ }
+#endif
/*
* If ip_dst matched any of my address on !IFF_UP interface,
* and there's no IFF_UP interface that matches ip_dst,

For FreeBSD RELENG_4:

Index: src/sys/netinet/ip_input.c
===================================================================
RCS file: /FREEBSD-CVS/src/sys/netinet/ip_input.c,v
retrieving revision 1.130.2.31
diff -u -r1.130.2.31 ip_input.c
--- src/sys/netinet/ip_input.c 2001/12/15 01:06:27 1.130.2.31
+++ src/sys/netinet/ip_input.c 2002/02/24 16:10:26
@@ -625,8 +625,18 @@
if (ipforwarding == 0) {
ipstat.ips_cantforward++;
m_freem(m);
- } else
+ } else {
+#ifdef IPSEC
+ /*
+ * Enforce inbound IPsec SPD.
+ */
+ if (ipsec4_in_reject(m, NULL)) {
+ ipsecstat.in_polvio++;
+ goto bad;
+ }
+#endif /* IPSEC */
ip_forward(m, 0);
+ }
#ifdef IPFIREWALL_FORWARD
ip_fw_fwd_addr = NULL;
#endif


NetBSD NetBSD 1.5.1

• NetBSD SA2002-003-SPD-1.5.patch
  To patch: # cd src # patch < /path/to/SA2002-003-SPD-1.5.patchThen build and install a new kernel. If you are not familiar with this process, documentation is available at: http://www.netbsd.org/Documentation/kernel/#how_to_build_a_kernel
  ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-003-SPD-1.5.pa tch

NetBSD NetBSD 1.5.2

• NetBSD SA2002-003-SPD-1.5.patch
  To patch: # cd src # patch < /path/to/SA2002-003-SPD-1.5.patchThen build and install a new kernel. If you are not familiar with this process, documentation is available at: http://www.netbsd.org/Documentation/kernel/#how_to_build_a_kernel
  ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-003-SPD-1.5.pa tch

Kame-Derived Stack Non-ESP IPV4 Forwarded Packets Policy Bypassing Vulnerability

References: