LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   "Firewall UDP Packet Source Port 53 Ruleset Bypass" (https://www.linuxquestions.org/questions/linux-security-4/firewall-udp-packet-source-port-53-ruleset-bypass-775606/)

fantasygoat 12-14-2009 01:25 PM
"Firewall UDP Packet Source Port 53 Ruleset Bypass"
 
A client is running a security scan on his website and getting the following critical hit:

Quote:
Firewall UDP Packet Source Port 53 Ruleset Bypass

It is possible to bypass the rules of the remote firewall by sending UDP packets with a source port equal to 53.
An attacker may use this flaw to inject UDP packets to the remote hosts, in spite of the presence of a firewall.
Anyone know how to prevent this critical trigger but still allow DNS lookups on the server?

win32sux 12-14-2009 01:44 PM
It sounds like you've got a firewall rule which allows incoming UDP packets with source port 53. If so, maybe get rid of that rule and rely on the ESTABLISHED match?

fantasygoat 12-14-2009 01:47 PM
The problem is, when I block anything with a source port of 53, all DNS queries fail, even though I expressly open all traffic from local addresses.

win32sux 12-14-2009 01:53 PM
Quote:
Originally Posted by fantasygoat (Post 3791276)
The problem is, when I block anything with a source port of 53, all DNS queries fail, even though I expressly open all traffic from local addresses.
Then you're not using the ESTABLISHED state.
Code:
iptables -I INPUT -m state --state ESTABLISHED -j ACCEPT
If you execute that command, your DNS queries should work just fine without the need for any source port rules.

fantasygoat 12-14-2009 01:56 PM
The very first rule in the list is to allow established connections.

win32sux 12-14-2009 01:57 PM
Okay, let's see the configuration of your INPUT and OUTPUT chains.
Code:
iptables -nvL INPUT
iptables -nvL OUTPUT
If this is a dedicated firewall (instead of host-based), post the FORWARD chain instead.

fantasygoat 12-14-2009 01:59 PM
Alas, this box is running ipfw, not iptables! It's quite old. I was hoping some general firewall knowledge would help.

win32sux 12-14-2009 02:08 PM
Quote:
Originally Posted by fantasygoat (Post 3791294)
Alas, this box is running ipfw, not iptables! It's quite old. I was hoping some general firewall knowledge would help.
You mean ipfw as in the FreeBSD firewall?

If this is GNU/Linux, then anything before iptables will be stateless AFAIK.

win32sux 12-14-2009 02:16 PM
FWIW, a stateless workaround for the issue mentioned in the raised alert would be to add the DNS server's IP as a source address to your current source port rule, thereby making it much more specific.


All times are GMT -5. The time now is 10:37 PM.