lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.LNX.4.64.0604102122350.11673@shalla.de>
Date: Mon, 10 Apr 2006 21:34:16 +0200 (CEST)
From: Christine Kronberg <seeker@...lla.de>
To: 3APA3A <3APA3A@...URITY.NNOV.RU>
Cc: bugtraq@...urityfocus.com
Subject: Re[2]: Bypassing ISA Server 2004 with IPv6


On Mon, 10 Apr 2006, 3APA3A wrote:
> --Wednesday, April 5, 2006, 2:12:10 PM, you wrote to bugtraq@...urityfocus.com:
>
>
> CK>    is  open  for any attacks as long as they are IPv6 based. If that
> CK>    is  right,  this is an extremly nasty bug. If ISA Server 2004 and
> CK>    Windows  2003  Basic  Firewall cannot filter that stuff it should
> CK>    simply drop it.
>
> You are not right.
>
> 1. IPv6 is not installed by default.
> 2. If IPv6 is installed, routing is not enabled by default.
> 3. If  you  install  IPv6,  you  can be bind it to only interfaces it's
> required. To prevent IPv6 (or another routable protocol, such as IPX) on
> external  interface  you  can (and you should) unbind this protocol from
> interface in network connection properties. ISA is not required for this
> task and is not supposed for this task.

   Thanks for clearing that. But: If ISA is not able to filter IPv6 so
   why can it be bound to an interface anyway? Just to route things
   through? Blindly through a firewall?
   Another posting talks about limited filtering capabilities. Roman
   wrote, icmp went through. So where is the borderline? It still seems
   to me that in the moment for what ever reason ipv6 is enabled on ISA
   the network it should secure is exposed.

   Cheers,

   Christine Kronberg.


-- 
Shalla Secure Services


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ