Linux kernel Netfilter MAC address filter bypass
| linux-netfilter-bypass-filter (7267) |  Medium Risk |
Description:
The Netfilter functions in Linux kernel could allow a remote attacker to bypass filtering mechanisms and gain unauthorized access to the system, caused by a vulnerability in the MAC match module. If the system uses MAC addresses as a basis for filtering, a remote attacker residing on the same network segment as the vulnerable system can send fragmented packets to the system to bypass the filter and gain unauthorized access to the system.
Platforms Affected:
- Linux, Kernel 2.4.1
- Linux, Kernel 2.4.10
- Linux, Kernel 2.4.11
- Linux, Kernel 2.4.2
- Linux, Kernel 2.4.3
- Linux, Kernel 2.4.4
- Linux, Kernel 2.4.5
- Linux, Kernel 2.4.6
- Linux, Kernel 2.4.7
- Linux, Kernel 2.4.8
- Linux, Kernel 2.4.9
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 AS
Remedy:
Apply the Netfilter patch included in the BugTraq Mailing List posting dated Oct 8 2001 10:50AM. See References.
Consequences:
Bypass Security
References:
- BugTraq Mailing List, Mon Oct 08 2001 - 04:50:58 CDT, Bug in Linux 2.4 / iptables MAC match module at http://archives.neohapsis.com/archives/bugtraq/2001-10/0057.html.
- BID-3418: Linux 2.4 Kernel MAC Module Filtering Bypassing Vulnerability
- CVE-2001-1572: The MAC module in Netfilter in Linux kernel 2.4.1 through 2.4.11, when configured to filter based on MAC addresses, allows remote attackers to bypass packet filters via small packets.
- RHSA-2003-195: kernel security update
Reported:
Oct 08, 2001
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net