bugtraq - Rule bypassing in CheckPoint NGX R60

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 07 Sep 2005 14:13:14 +0200
From: fitz <fitzimailing@...oo.de>
To: bugtraq@...urityfocus.com
Subject: Rule bypassing in CheckPoint NGX R60

Hi folks,

as playing a little bit with CheckPoint NGX new
release R60, I noticed a serious problem with the
predefined service group "CIFS".

This group includes the services called "microsoft-ds"
(TCP Port 445) and the predefined service group "NBT",
which includes some old smb-stuff.

If I use this predefined service group "CIFS" in a
rule, then every traffic matching the source an the
destination will pass the firewall, whatever service
it is (icmp, telnet and so on.). So its the same like
using "ANY" in the services column.

Workaround: Create an own group called "CIFS-custom"
(e.g.) and put the service "microsoft-ds" and
service-group "NBT" in it and use this in your
rulebase.

BTW: I tested it at SecurePlatform NGX (R60) Build
244.... and didn't checked older releases and
versions.