Login
Newsletter
Werbung

Sicherheit: Umgehung von Rechteprüfungen in shorewall
Aktuelle Meldungen Distributionen
Name: Umgehung von Rechteprüfungen in shorewall
ID: 200507-20
Distribution: Gentoo
Plattformen: Keine Angabe
Datum: Fr, 22. Juli 2005, 13:00
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2317
http://www.shorewall.net/News.htm#20050717
Applikationen: Shoreline Firewall

Originalnachricht

--nextPart1129576.uHdl6B9Hbn
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200507-20
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: Shorewall: Security policy bypass
Date: July 22, 2005
Bugs: #99398
ID: 200507-20

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A vulnerability in Shorewall allows clients authenticated by MAC
address filtering to bypass all other security rules.

Background
==========

Shorewall is a high level tool for configuring Netfilter, the firewall
facility included in the Linux Kernel.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-firewall/shorewall < 2.4.1 *>= 2.2.5
>= 2.4.1

Description
===========

Shorewall fails to enforce security policies if configured with
"MACLIST_DISPOSITION" set to "ACCEPT" or "MACLIST_TTL"
set to a value
greater or equal to 0.

Impact
======

A client authenticated by MAC address filtering could bypass all
security policies, possibly allowing him to gain access to restricted
services.

Workaround
==========

Set "MACLIST_TTL" to "0" and "MACLIST_DISPOSITION" to
"REJECT" in the
Shorewall configuration file (usually /etc/shorewall/shorewall.conf).

Resolution
==========

All Shorewall users should upgrade to the latest available version:

# emerge --sync
# emerge --ask --oneshot --verbose net-firewall/shorewall

References
==========

[ 1 ] CAN-2005-2317
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2317
[ 2 ] Shorewall Announcement
http://www.shorewall.net/News.htm#20050717

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200507-20.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

--nextPart1129576.uHdl6B9Hbn

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQBC4IW/zKC5hMHO6rkRAg9nAJ9D7fLyJ3ayYym9NOykE5IXscp/CwCaAvUk
XfUt1IaoVdVbgp1/+g4cr5I=
=fqFC
-----END PGP SIGNATURE-----

--nextPart1129576.uHdl6B9Hbn
Content-Disposition: attachment
Content-Transfer-Encoding: 7bit

--nextPart1129576.uHdl6B9Hbn--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung