BID:4725

Multiple Vendor Firewall Port 53 Communication Vulnerability

Info

Multiple Vendor Firewall Port 53 Communication Vulnerability

Bugtraq ID:	4725
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	No
Published:	May 10 2002 12:00AM
Updated:	May 10 2002 12:00AM
Credit:	Posted to BugTraq on May 10, 2002 by Christian decoder Holler <[email protected]>
Vulnerable:	Tiny Personal Firewall 2.0.15 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home Tiny Personal Firewall 2.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Tiny Personal Firewall 1.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 ATGuard ATGuard Personal Firewall 3.2

Not Vulnerable:

Discussion

Multiple Vendor Firewall Port 53 Communication Vulnerability

Tiny Personal Firewall 2.0 is a simple personal firewall for Windows based machines. It is reported to allow any communication over port 53 for DNS purposes; this could be problematic if the DNS server was not explicitely defined in the firewall configuration. This could open the way for a trojan that uses port 53 to bypass the firewall. ATGuard 3.2 is also reported to be vulnerable to this issue.

Exploit / POC

Multiple Vendor Firewall Port 53 Communication Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Multiple Vendor Firewall Port 53 Communication Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

References

Multiple Vendor Firewall Port 53 Communication Vulnerability

References:

Personal Firewall Homepage (Tiny Software)