| Author |
Message |
vitrum
Joined: 08 Dec 2003
Posts: 19
Location: Socal
|
| Posted: Mon Aug 23, 2004 10:16 pm Post subject: IPTables / Avoiding UDP Vuln |
|
|
http://cgi.nessus.org/plugins/dump.php3?id=11580
Anyone have any suggestions for IPTables rules that can be used to avoid this type of firewall vulnerability? Also anyone know of a simple method of testing it?
I can see methods of protecting yourself if you are not running an authoritative DNS server... however if you are... it seems a bit more tricky. |
|
| Back to top |
|
jeffml
Joined: 03 Feb 2004
Posts: 13
|
| Posted: Tue Aug 24, 2004 12:37 am Post subject: Re: IPTables / Avoiding UDP Vuln |
|
|
vitrum wrote: http://cgi.nessus.org/plugins/dump.php3?id=11580
Anyone have any suggestions for IPTables rules that can be used to avoid this type of firewall vulnerability? Also anyone know of a simple method of testing it?
I can see methods of protecting yourself if you are not running an authoritative DNS server... however if you are... it seems a bit more tricky.
This seems to be a vulnerabilty in Kerio Personal Firewall as per the referenced BugTraq ID. As long as you don't open a hole for everything with udp src port 53 you should be fine. |
|
| Back to top |
|
vitrum
Joined: 08 Dec 2003
Posts: 19
Location: Socal
|
| Posted: Tue Aug 24, 2004 12:40 am Post subject: |
|
|
Well if your running a DNS server you have to have UDP 53 open... :(
And I don't know is this a vuln that only affects Kerio? I read that too, but I also read a few places that lead me to believe this affects IPTables as well... |
|
| Back to top |
|
vitrum
Joined: 08 Dec 2003
Posts: 19
Location: Socal
|
| Posted: Tue Aug 24, 2004 12:50 am Post subject: |
|
|
I read a recommendation for the following rules... however I'm not sure how to sucessfully test it for certain...
Code:
/sbin/iptables -A INPUT -p udp --dport 53 -j ACCEPT
/sbin/iptables -A INPUT -p udp -m state --state ESTABLISHED --sport 53 -j ACCEPT
/sbin/iptables -A INPUT -p udp --sport 53 -j DROP
|
|
| Back to top |
|
jricher
Joined: 15 Dec 2004
Posts: 4
|
| Posted: Thu Dec 16, 2004 7:29 pm Post subject: Testing |
|
|
You can test for this from any other box using a tools like nmap. You can get this at insecure.org.
Jacques |
|
| Back to top |
|
| |
