OpenBSD PF RDR Network Information Leakage Vulnerability

Bugtraq ID:	8082
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 02 2003 12:00AM
Updated:	Jul 02 2003 12:00AM
Credit:	Discovery of this issue is credited to Ed3f <[email protected]>.
Vulnerable:	OpenBSD OpenBSD 3.2 OpenBSD OpenBSD 3.1 OpenBSD OpenBSD 3.0
Not Vulnerable:

OpenBSD PF RDR Network Information Leakage Vulnerability

OpenBSD PF is prone to an information leakage vulnerability when configured to redirect incoming traffic from standard ports to high ports. This occurs because PF responds different to packets destined for active private addresses than to those destined for inactive ones. This could be exploited to enumerate network resources for other network segments in preparation for further attacks.

OpenBSD PF RDR Network Information Leakage Vulnerability

This issue can be exploited with a port scanner such as nmap. The following proof-of-concept examples were submitted:

nmap -sS -P0 -n -T 4 -p 25 10.0.0.0/8

nmap -sS -P0 -n -T 4 -p 25,8025,1025,2500 10.0.0.0/8

OpenBSD PF RDR Network Information Leakage Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

OpenBSD PF RDR Network Information Leakage Vulnerability

References:

• OpenBSD Homepage (OpenBSD)
  
• OpenBSD PF :: "rdr" information leakage (Ed3f )