(Check Point Issues Fix for FireWall-1/VPN-1) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1009904 |
|
SecurityTracker URL: http://securitytracker.com/id/1009904
|
|
CVE Reference:
CVE-2004-0230
(Links to External Site)
|
Date: Apr 21 2004
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): NG
|
Description:
A vulnerability was reported in several TCP stack implementations. A remote user may be able to cause denial of service conditions using a TCP reset attack. Check Point FireWall-1/VPN-1 NG is affected.
The UK National Infrastructure Security Co-Ordination Centre (NISCC) reported that some implementations of the Transmission Control Protocol (TCP) are particularly vulnerable to TCP reset attacks. A remote user can cause TCP sessions to terminate prematurely, causing denial of service conditions.
The specific impact on applications that use TCP depends on the mechanisms built into the application to address premature TCP session termination.
According to the report, NISCC considers the Border Gateway Protocol (BGP) to be one of the most affected applications, as it relies on a persistent TCP session between BGP peer entities. Premature termination of an underlying TCP session may require routing tables to be rebuilt and may cause "route flapping". In the case of BGP, using the TCP MD5 Signature Option and anti-spoofing measures can mitigate the vulnerability.
Other applications, such as Domain Name System (DNS) and (Secure Sockets Layer) SSL based applications may also be affected, but to a lesser degree, the report said.
A remote user can reportedly send a TCP packet with the RST (reset) flag set (or the SYN flag) with the appropriate spoofed source and destination IP addresses and TCP ports to cause the TCP session to be terminated. Ordinarily, the remote user may have the probability of 1 in 2^32 of guessing the correct sequence number, the report said. However, in actuality, a remote user may be able to guess an appropriate sequence number with much greater probability because many implementations will accept any sequence number within a certain window of the expected sequence number. The Associate Press reports that the proper number can be guessed within as few as four attempts, requiring only seconds to achieve.
The report credits Paul A. Watson for discovering a practical method for conducting TCP reset attacks (presented in "Slipping In The Window: TCP Reset Attacks" at the CanSecWest 2004 conference).
The report indicates that the following vendors are affected [this is not an inclusive list]:
- Cray Inc. is vulnerable on their UNICOS, UNICOS/mk and UNICOS/mp systems
- Check Point is affected, but has issued a protection mechanism in the latest release for VPN-1/FireWall-1 (R55 HFA-03) that can protect both the firewall device and hosts located behind the firewall.
- Internet Initiative Japan, Inc (IIJ) is affected.
- InterNiche NicheStack and NicheLite are affected.
- Juniper Networks products are affected.
- Cisco products are affected, including IOS and non-IOS based devices.
Other vendors are assessing the impact of this flaw.
The NISCC Vulnerability Advisory 236929 is available at:
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
|
Impact:
A remote user can cause denial of service on the target TCP session. The specific impact depends on the specific vendor implementation.
|
Solution:
Check Point reported that Check Point SecurePlatform NG (and above) is affected by the recently reported TCP reset vulnerability.
Customers using older versions of NG or NG with Application Intelligence should apply NG FP3 HFA-325 or R54 HFA-410.
Check Point notes that a fixed version of the firewall can be used to protect hosts on an internal network from a TCP reset attack.
VPN-1/FireWall-1 NG with Application Intelligence R55 Hotfix HFA-03:
R55 HFA-03 for IPSO:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=IPSO%203.7&patchlevel_selected=R55%20-%20Hotfixes
R55 HFA-03 for Linux:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=Linux&patchlevel_selected=R55%20-%20Hotfixes
R55 HFA-03 for SecurePlatform
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=SecurePlatform&patchlevel_selected=R55%20-%20Hotfixes
R55 HFA-03 for Solaris:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=Solaris%202.8&patchlevel_selected=R55%20-%20Hotfixes
R55 HFA-03 for Windows:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=Windows%20NT&patchlevel_selected=R55%20-%20Hotfixes
VPN-1/FireWall-1 NG with Application Intelligence R54 HFA-410:
R54 HFA-410 for IPSO:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=IPSO%203.7&patchlevel_selected=R54%20-%20Hotfixes
R54 HFA-410 for Linux:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=Linux&patchlevel_selected=R54%20-%20Hotfixes
R54 HFA-410 for SecurePlatform:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=SecurePlatform&patchlevel_selected=R54%20-%20Hotfixes
R54 HFA-410 for Solaris:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=Solaris%202.8&patchlevel_selected=R54%20-%20Hotfixes
R54 HFA-410 for Windows:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=Windows%20NT&patchlevel_selected=R54%20-%20Hotfixes
VPN-1/FireWall-1 Next Generation FP3 HFA-325:
FP3 HFA-325 for IPSO:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG&os_selected=IPSO%203.6&patchlevel_selected=FP3%20-%20Hotfixes
FP3 HFA-325 for Linux:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG&os_selected=Linux&patchlevel_selected=FP3%20-%20Hotfixes
FP3 HFA-325 for SecurePlatform:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG&os_selected=SecurePlatform%20FP3%20Edition%202&patchlevel_selected=FP3%20-%20Hotfixes
FP3 HFA-325 for Solaris:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG&os_selected=Solaris%202.8&patchlevel_selected=FP3%20-%20Hotfixes
FP3 HFA-325 for Windows:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG&os_selected=Windows%20NT&patchlevel_selected=FP3%20-%20Hotfixes
After installation, there are important configuration instructions in the advisory regarding setting the kernel global variable fwseqvalid_exact_syn_on_rst to control this feature.
|
Vendor URL: www.checkpoint.com/techsupport/alerts/tcp_dos.html (Links to External Site)
|
Cause:
State error
|
Underlying OS:
Linux (Any), UNIX (Solaris - SunOS), Windows (NT), Windows (2000)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Wed, 21 Apr 2004 18:18:14 -0400
Subject: http://www.checkpoint.com/techsupport/alerts/tcp_dos.html
|
http://www.checkpoint.com/techsupport/alerts/tcp_dos.html
Check Point reported that Check Point SecurePlatform NG (and above) is affected by the
recently reported TCP reset vulnerability.
Customers using older versions of NG or NG with Application Intelligence should apply NG
FP3 HFA-325 or R54 HFA-410.
Check Point notes that a fixed version of the firewall can be used to protect hosts on an
internal network from a TCP reset attack.
The following fixes are available:
VPN-1/FireWall-1 NG with Application Intelligence R55 Hotfix HFA-03:
R55 HFA-03 for IPSO:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=IPSO%203.7&patchlevel_selected=R55%20-%20Hotfixes
R55 HFA-03 for Linux:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=Linux&patchlevel_selected=R55%20-%20Hotfixes
R55 HFA-03 for SecurePlatform
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=SecurePlatform&patchlevel_selected=R55%20-%20Hotfixes
R55 HFA-03 for Solaris:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=Solaris%202.8&patchlevel_selected=R55%20-%20Hotfixes
R55 HFA-03 for Windows:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=Windows%20NT&patchlevel_selected=R55%20-%20Hotfixes
VPN-1/FireWall-1 NG with Application Intelligence R54 HFA-410:
R54 HFA-410 for IPSO:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=IPSO%203.7&patchlevel_selected=R54%20-%20Hotfixes
R54 HFA-410 for Linux:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=Linux&patchlevel_selected=R54%20-%20Hotfixes
R54 HFA-410 for SecurePlatform:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=SecurePlatform&patchlevel_selected=R54%20-%20Hotfixes
R54 HFA-410 for Solaris:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=Solaris%202.8&patchlevel_selected=R54%20-%20Hotfixes
R54 HFA-410 for Windows:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=Windows%20NT&patchlevel_selected=R54%20-%20Hotfixes
VPN-1/FireWall-1 Next Generation FP3 HFA-325:
FP3 HFA-325 for IPSO:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG&os_selected=IPSO%203.6&patchlevel_selected=FP3%20-%20Hotfixes
FP3 HFA-325 for Linux:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG&os_selected=Linux&patchlevel_selected=FP3%20-%20Hotfixes
FP3 HFA-325 for SecurePlatform:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG&os_selected=SecurePlatform%20FP3%20Edition%202&patchlevel_selected=FP3%20-%20Hotfixes
FP3 HFA-325 for Solaris:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG&os_selected=Solaris%202.8&patchlevel_selected=FP3%20-%20Hotfixes
FP3 HFA-325 for Windows:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=VPN-1/FireWall-1&version_selected=NG&os_selected=Windows%20NT&patchlevel_selected=FP3%20-%20Hotfixes
Provider-1 NG with Application Intelligence R55 Hotfix HFA:
R55 HFA-03 for Solaris MDS:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=Provider-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=Solaris%202.9&patchlevel_selected=R55
Provider-1 NG with Application Intelligence R54 Hotfix HFA:
R54 HFA-410 for Solaris MDS:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=Provider-1&version_selected=NG%20with%20Application%20Intelligence&os_selected=Solaris%202.9&patchlevel_selected=R54
Provider-1 NG FP3 Hotfix HFA:
NG FP3 HFA-325 for Solaris MDS:
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp?the_product=Provider-1&version_selected=NG&os_selected=Solaris%202.8&patchlevel_selected=FP3
|
|
