"Firewall UDP Packet Source Port 53 Ruleset Bypass"

fantasygoat · 12-14-2009, 01:25 PM

A client is running a security scan on his website and getting the following critical hit:

Quote:

Firewall UDP Packet Source Port 53 Ruleset Bypass

It is possible to bypass the rules of the remote firewall by sending UDP packets with a source port equal to 53.
An attacker may use this flaw to inject UDP packets to the remote hosts, in spite of the presence of a firewall.

Anyone know how to prevent this critical trigger but still allow DNS lookups on the server?

win32sux · 12-14-2009, 01:44 PM

It sounds like you've got a firewall rule which allows incoming UDP packets with source port 53. If so, maybe get rid of that rule and rely on the ESTABLISHED match?

fantasygoat · 12-14-2009, 01:47 PM

The problem is, when I block anything with a source port of 53, all DNS queries fail, even though I expressly open all traffic from local addresses.

win32sux · 12-14-2009, 01:53 PM

Quote:

Originally Posted by fantasygoat

The problem is, when I block anything with a source port of 53, all DNS queries fail, even though I expressly open all traffic from local addresses.

Then you're not using the ESTABLISHED state.

Code:

iptables -I INPUT -m state --state ESTABLISHED -j ACCEPT

If you execute that command, your DNS queries should work just fine without the need for any source port rules.

fantasygoat · 12-14-2009, 01:56 PM

The very first rule in the list is to allow established connections.

win32sux · 12-14-2009, 01:57 PM

Okay, let's see the configuration of your INPUT and OUTPUT chains.

Code:

iptables -nvL INPUT
iptables -nvL OUTPUT

If this is a dedicated firewall (instead of host-based), post the FORWARD chain instead.

fantasygoat · 12-14-2009, 01:59 PM

Alas, this box is running ipfw, not iptables! It's quite old. I was hoping some general firewall knowledge would help.

win32sux · 12-14-2009, 02:08 PM

Quote:

Originally Posted by fantasygoat

Alas, this box is running ipfw, not iptables! It's quite old. I was hoping some general firewall knowledge would help.

You mean ipfw as in the FreeBSD firewall?

If this is GNU/Linux, then anything before iptables will be stateless AFAIK.

win32sux · 12-14-2009, 02:16 PM

FWIW, a stateless workaround for the issue mentioned in the raised alert would be to add the DNS server's IP as a source address to your current source port rule, thereby making it much more specific.