AIX Filtering Vulnerability

Bugtraq ID:	744
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 26 1999 12:00AM
Updated:	Oct 26 1999 12:00AM
Credit:	First posted to BugTraq by Brumbles <[email protected]> on Oct 26, 1999.
Vulnerable:	IBM AIX 4.3.2
Not Vulnerable:

AIX Filtering Vulnerability

The filtering modules for AIX 4.3.2 do not allow you to filter tcp port numbers higher than 32767. This example was in the BugTraq posting regarding this problem:

genfilt -v 4 -a D -s 0.0.0.0 -m 0.0.0.0 -d 0.0.0.0 -M 0.0.0.0 \ -c udp -o any -O eq -P 123 -l n -w I -i all

Works fine... but...

genfilt -v 4 -a D -s 0.0.0.0 -m 0.0.0.0 -d 0.0.0.0 -M 0.0.0.0 -c udp \ -o any -O eq -P 32768 -l n -w I -i all

Fails with: Bad destination port/ICMP type "32768".

It is believed that this problem is a result of incorrect type (short int) being used for the port number argument.

Compromise may occur through services listening on ports that are higher than 32767.

AIX Filtering Vulnerability

See discussion.

AIX Filtering Vulnerability

Solution:
AIX has assigned this problem to defect 289790 and is working on a fix.

Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

AIX Filtering Vulnerability

References: