full-disclosure - Re: DNS and Checkpoint

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BAY118-W32EEC81BB9F0A948DCD7ABDD910@phx.gbl>
Date: Thu, 10 Jul 2008 01:35:09 +0000
From: Ray P <sixsigma98@...mail.com>
To: imipak <imipak@...il.com>, Full Disclosure
	<full-disclosure@...ts.grok.org.uk>
Subject: Re: DNS and Checkpoint


The article you're looking at is for their SmartDefense product, an add-in to Firewall-1. Supposedly it will protect a DNS server behind the firewall from this vulnerability.

Ray

> Date: Wed, 9 Jul 2008 15:00:39 +0100
> From: imipak@...il.com
> To: full-disclosure@...ts.grok.org.uk
> Subject: [Full-disclosure] DNS and Checkpoint
> 
> Hello everyone,
> 
> I've had a report from someone with clue (and tcpdump) that a properly
> functioning DNS resolver that correctly uses randomised source ports
> magically becomes vulnerable once the traffic's passed through a
> Checkpoint firewall, where Dan Kaminsky's tool shows:
> 
>     x.y.z.155:56978 TXID=712
>     x.y.z.155:56979 TXID=45713
>     x.y.z.155:56980 TXID=63532
>     x.y.z.155:56981 TXID=7243
>     x.y.z.155:56982 TXID=17620
> 
> (note the incrementing port numbers.)
> 
> Can anyone else confirm this behaviour?
> 
> Checkpoint are one of the dozens of vendors listed on the CERT
> advisory as "Status: Unknown"
> http://www.kb.cert.org/vuls/id/MIMG-7ECL6B
> 
> They do have an advisory up:
>     http://www.checkpoint.com/defense/advisories/public/2008/cpai-01-Jul.html
> 
> I don't have the login needed to read the whole thing, but the front
> page just says:
> 
> "Protection provided by:
>  	 VPN-1:    * NGX R65
>                        * NGX R62
>                        * NGX R61
>                        * NGX R60
>         [...etc, etc...] "
> 
> 
> cheers
> 
> =i
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_________________________________________________________________
Need to know now? Get instant answers with Windows Live Messenger.
http://www.windowslive.com/messenger/connect_your_way.html?ocid=TXT_TAGLM_WL_messenger_072008
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/