IPFilter firewall race condition
| ipfilter-firewall-race-condition (4994) |  Medium Risk |
Description:
IP Filter is vulnerable to a race condition. When IP Filter rulesets are created with "return-rst" and "keep state" overlapping, a race condition occurs. A remote attacker could exploit this vulnerability to bypass firewall restrictions.
Platforms Affected:
- Darren Reed, IPFilter 3.3.15 and prior
- Darren Reed, IPFilter 3.4.3 and prior
Remedy:
Upgrade to the latest version of IPFilter (3.3.16 or 3.4.4 or later), available from the IP Filter Web site. See References.
Consequences:
Bypass Security
References:
- BugTraq Mailing List, Thu May 25 2000 - 23:04:56 CDT, Security Vulnerability in IPFilter 3.3.15 and 3.4.3 at http://archives.neohapsis.com/archives/bugtraq/2000-05/0326.html.
- IP Filter Web site, TCP/IP Packet Filtering package at http://coombs.anu.edu.au/~avalon/ipfil-new.html.
- BID-1308: IPFilter Firewall Race Condition Vulnerability
- CVE-2000-0553: Race condition in IPFilter firewall 3.4.3 and earlier, when configured with overlapping return-rst and keep state rules, allows remote attackers to bypass access restrictions.
- OSVDB ID: 1377: IPFilter Firewall SYN/RST Race Condition
Reported:
May 25, 2000
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net