Security flaw in Linux 2.4 IPTables using FTP PORT

[M K Saravanan <mksarav@xxxxxxxxxxxxxxxxx>]

---------- Forwarded message ----------
Date: Wed, 18 Apr 2001 02:11:06 -0700 (PDT)
From: Soh Kam Yung <firstspeaker.geo@xxxxxxxxx>
Reply-To: firstspeaker@xxxxxxxxxxxxx
To: slugnet@xxxxxxxxxxxxxxxxx
Subject: [lugs] [Advisory] Security flaw in Linux 2.4 IPTables using FTP
    PORT

Found via newsforge (http://newsforge.com/) at Tempest Security
Technologies (http://www.tempest.com.br/advisories/01-2001.html):

=====Start=====
Security Advisory - #01/2001    
   
Security flaw in Linux 2.4 IPTables using FTP PORT

Tempest Security Technologies
a business unit of CESAR - Centro de Estudos e Sistemas Avançados do
Recife
   
Author: Cristiano Lincoln Mattos, CISSP, SSCP <lincoln@xxxxxxxxxxxx>
Recife, Pernambuco, Brazil
   
Systems affected: Firewalls using Linux Kernel 2.4.x with IPTables
Release date: 16 April 2001
Platforms: Linux Kernel 2.4.x

Impact: If an attacker can establish an FTP connection passing through
a Linux 2.4.x IPTables firewall with the state options allowing
"related" connections (almost 100% do), he can insert entries into the
firewall's RELATED ruleset table allowing the FTP Server to connect to
any host and port protected by the firewalls rules, including the
firewall itself.

[...]

Solutions
   
First and foremost, you should tighten your firewall rules to limit
the scope of this vulnerability, by only allowing RELATED connections
to the hosts that really need them, and not to all connections.

The NetFilter core team was notified and quickly developed a patch. It
is available at:
   http://netfilter.samba.org/security-fix/
   http://netfilter.gnumonks.org/security-fix/
   http://netfilter.filewatcher.org/security-fix/

[...]
=====End=====


=====
Soh Kam Yung
email: firstspeaker@xxxxxxxxxxxxx
homepage: http://www.geocities.com/firstspeaker.geo/index.html