bugtraq - AW: Symantec Gateway Security DNS exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <44ec8ea8.29bbbdbe.4e0c.2f46@mx.gmail.com>
Date: Wed, 23 Aug 2006 19:21:34 +0200
From: "Andre Braun" <braun.andre@...il.com>
To: <bugtraq@...urityfocus.com>
Subject: AW: Symantec Gateway Security DNS exploit

The Bind Server on SGS don´t accepts Zone Transfers to Outside Zones.
But there are Proxies on the SGS which serve Services to outside, but
Symantec havent changed it yet....

-----Ursprüngliche Nachricht-----
Von: Gianstefano Monni [mailto:gianstefano@...nu.it] 
Gesendet: Mittwoch, 23. August 2006 10:02
An: bugtraq@...urityfocus.com; ml@...urezza.org
Betreff: Symantec Gateway Security DNS exploit

I. THE SYSTEM
Symantec Gateway Security (SGS) is an enterprise-class appliance with a
linux-based stateful inspection firewall and application proxy
capabilities (http/https, ftp, smtp, dns, and so on).
Using the default installation the system keeps listening on the WAN
interface for all its proxies. All the proxies use an authentication
system and everything seems ok. DNS until now can not use authentication
system...

2. THE EXPLOIT
One could connect to the 53/tcp or 53/udp ports of the SGS and use it as a
dns server, for instance to make some "noisy" queries to primary dns
servers (zone transfers, and so on). This could be a problem if,for
instance, those types of queries are logged: in this case the source ip
will be the address of the SGS...

3. THE SOLUTION
A solution could be, for instance, to create a filter (i.e. an iptables
rule) in the SGS to cutoff all the queries coming from outside, taking
into account some particular situation as, for instance, VPNs or DMZs on
the red interface...

-- 
We reject kings, presidents and voting
We believe in rough consensus and running code
IETF Credo