Archive of FreeBSD Security general posting, FreeBSD Security Advisory: FreeBSD-SA-01:08.ipfw

24/01/01, FreeBSD Security Advisory: FreeBSD-SA-01:08.ipfw
From: FreeBSD Security Advisories <security-advisories@FreeBSD.ORG>

Generated by MHonArc

CSIM Logo WelcomeCourses
Faculty, Student, Staff
Projects and reports
Conferences, workshop and seminars
Laboratories and reasearch facilities
Information related to CSIM
Information non-related to CSIM
Address, map, phone, etc.

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

To: FreeBSD Security Advisories <security-advisories@FreeBSD.ORG>
Subject: FreeBSD Security Advisory: FreeBSD-SA-01:08.ipfw
From: FreeBSD Security Advisories <security-advisories@FreeBSD.ORG>
Date: Tue, 23 Jan 2001 13:08:23 -0800 (PST)
Mail-from: From owner-freebsd-security-notifications@FreeBSD.ORG Wed Jan 24 04:09:07 2001
Reply-To: postmaster@FreeBSD.ORG
Sender: owner-freebsd-security-notifications@FreeBSD.ORG


FreeBSD-SA-01:08                                           Security Advisory
                                                                FreeBSD, Inc.

Topic:		ipfw/ip6fw allows bypassing of 'established' keyword

Category:	core
Module:		kernel
Announced:	2001-01-23
Credits:	Aragon Gouveia <>
Affects:	FreeBSD 3.x (all releases), FreeBSD 4.x (all releases),
		FreeBSD 3.5-STABLE and 4.2-STABLE prior to the
		correction date.
Corrected:	2001-01-09 (FreeBSD 4.2-STABLE)
		2001-01-12 (FreeBSD 3.5-STABLE)
FreeBSD only:	Yes

I.   Background

ipfw is a system facility which allows IP packet filtering,
redirecting, and traffic accounting.  ip6fw is the corresponding
utility for IPv6 networks, included in FreeBSD 4.0 and above.  It is
based on an old version of ipfw and does not contain as many features.

II.  Problem Description

Due to overloading of the TCP reserved flags field, ipfw and ip6fw
incorrectly treat all TCP packets with the ECE flag set as being part
of an established TCP connection, which will therefore match a
corresponding ipfw rule containing the 'established' qualifier, even
if the packet is not part of an established connection.

The ECE flag is not believed to be in common use on the Internet at
present, but is part of an experimental extension to TCP for
congestion notification.  At least one other major operating system
will emit TCP packets with the ECE flag set under certain operating

Only systems which have enabled ipfw or ip6fw and use a ruleset
containing TCP rules which make use of the 'established' qualifier,
such as "allow tcp from any to any established", are vulnerable.  The
exact impact of the vulnerability on such systems is undetermined and
depends on the exact ruleset in use.

All released versions of FreeBSD prior to the correction date
including FreeBSD 3.5.1 and FreeBSD 4.2 are vulnerable, but it was
corrected prior to the (future) release of FreeBSD 4.3.

III. Impact

Remote attackers who construct TCP packets with the ECE flag set may
bypass certain ipfw rules, allowing them to potentially circumvent
the firewall.

IV.  Workaround

Because the vulnerability only affects 'established' rules and ECE-
flagged TCP packets, this vulnerability can be removed by adjusting
the system's rulesets.  In general, it is possible to express most
'established' rules in terms of a general TCP rule (with no TCP flag
qualifications) and a 'setup' rule, but may require some restructuring
and renumbering of the ruleset.

V.   Solution

One of the following:

1) Upgrade the vulnerable FreeBSD system to FreeBSD 3.5-STABLE, or
or 4.2-STABLE after the correction date.

2) Patch your present system by downloading the relevant patch from the
below location:

[FreeBSD 4.x]
# fetch
# fetch

[FreeBSD 3.x]
# fetch
# fetch

Verify the detached PGP signature using your PGP utility.

Execute the following commands as root:

# cd /usr/src
# patch -p < /path/to/patch
# cp /usr/src/sys/netinet/tcp.h /usr/src/sys/netinet/ip_fw.h /usr/include/netinet/
# cd /usr/src/sbin/ipfw
# make depend && make all install
# cd /usr/src/sys/modules/ipfw
# make depend && make all install

For 4.x systems, perform the following additional steps:

# cp /usr/src/sys/netinet6/ip6_fw.h /usr/include/netinet6/
# cd /usr/src/sbin/ip6fw
# make depend && make all install
# cd /usr/src/sys/modules/ip6fw
# make depend && make all install

NOTE: The ip6fw patches have not yet been tested but are believed to
be correct.  The ip6fw software is not currently maintained and may be
removed in a future release.

If the system is using the ipfw or ip6fw kernel modules (see
kldstat(8)), the module may be unloaded and the corrected module
loaded into the kernel using kldload(8)/kldunload(8).  This will
require that the firewall rules be reloaded, usually be executing the
/etc/rc.firewall script.  Because the loading of the ipfw or ip6fw
module will result in the system denying all packets by default, this
should only be attempted when accessing the system via console or by
careful use of a command such as:

# kldload ipfw && sh /etc/rc.firewall

which performs both operations sequentially.

Otherwise, if the system has ipfw or ip6fw compiled into the kernel,
the kernel will also have to be recompiled and installed, and the
system will have to be rebooted for the changes to take effect.
Version: GnuPG v1.0.4 (FreeBSD)
Comment: For info see


To Unsubscribe: send mail to
with "unsubscribe freebsd-security-notifications" in the body of the message

Previous message sorted by date: FreeBSD Ports Security Advisory: FreeBSD-SA-01:06.zope
Next message sorted by date: FreeBSD Security Advisory: FreeBSD-SA-01:09.crontab
Previous message sorted by thread: FreeBSD Ports Security Advisory: FreeBSD-SA-01:06.zope
Next message by thread: FreeBSD Security Advisory: FreeBSD-SA-01:09.crontab
Main Index
Thread Index

CSIM home pageWMailAccount managementCSIM LibraryNetwork test toolsSearch CSIM directories
Contact us: Olivier Nicole CSIM    SET    AIT Last update: Jan 2002