-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===============================================================================
>>                                                      CERT-NL, 01-Mar-2000 <<
>> All CERT-NL information has been moved to http://cert.surfnet.nl.  Links  <<
>> to CERT-NL information contained in this advisory are therefore outdated. <<
>>                                                                           <<
>> CERT-NL also has stopped the CERT-CC-Mirror service.  Due to this the     <<
>> links to the CERT-CC mirror are obsolete. Visit the CERT-CC site for the  <<
>> complete CERT-CC advisory texts:                     http://www.cert.org  <<
===============================================================================
===============================================================================
Security Advisory                                                       CERT-NL
===============================================================================
Author/Source : Teun Nijssen                                Index  :    S-96-30
Distribution  : World                                       Page   :          1
Classification: External                                    Version:          1
Subject       : FreeBSD Firewall filter leak                Date   :  24-jun-96
===============================================================================

By courtesy of the FreeBSD Security Officer we received
information on a vulnerability in FreeBSD's internal packet filter.

CERT-NL recommends to apply patches as recommended.
===============================================================================

Topic: Firewall filter leak with user level ipfw

Category:  core
Module:    ipfw
Announced:  1996-06-24
Affects:        FreeBSD -current Feb 24 1996 and later (ipfw.c rev 1.20)
                FreeBSD -stable Feb 26 1996 and later (ipfw.c rev 1.15.4.2)
Corrected:      Both FreeBSD -current and -stable as of Jun 23 1996
FreeBSD only:   yes

Patches:  ftp://freebsd.org/pub/CERT/patches/SA-96:14/

=============================================================================

I.   Background

     FreeBSD is shipped with packet filtering code. This is implemented
     by kernel level modules and user level programs. The user level
     program ipfw, used to control the packet filtering code in the
     kernel, has a bug in the way packet filter rules are interpreted.


II.  Problem Description

     A potential problem exists when users specify mask addresses to
     ipfw(8) using the address:mask syntax.  Specifically, whenever the ':'
     syntax is used, the resulting mask is always 0xffffffff.


III. Impact

     Whenever the address:mask syntax is used, the actual packet filtering
     will differ from the expected filtering thus allowing or denying
     more packets through the filter than intended.


IV. Workaround

     There is a simple workaround for this problem: Do not use the
     address:mask syntax. In stead, use the address/mask syntax. The
     implementation of the latter way of specifying masks does not suffer
     from the mentioned bug.

V. Solution

     Apply one of the patches below, depending on your version of
     FreeBSD. The patch is against /usr/src/sbin/ipfw/ipfw.c

     The following patch applies to -stable:


Index: ipfw.c
===================================================================
RCS file: /home/ncvs/src/sbin/ipfw/ipfw.c,v
retrieving revision 1.15.4.4
retrieving revision 1.15.4.5
diff -u -r1.15.4.4 -r1.15.4.5
- - --- ipfw.c  1996/06/18 02:03:29  1.15.4.4
+++ ipfw.c  1996/06/23 20:51:37  1.15.4.5
@@ -15,7 +15,7 @@
  *
  * NEW command line interface for IP firewall facility
  *
- - - * $Id: ipfw.c,v 1.15.4.4 1996/06/18 02:03:29 alex Exp $
+ * $Id: ipfw.c,v 1.15.4.5 1996/06/23 20:51:37 alex Exp $
  *
  */

@@ -200,7 +200,7 @@
  }

  if (chain->fw_flg & IP_FW_F_FRAG)
- - -    printf("frag ");
+    printf(" frag ");

  if (chain->fw_ipopt || chain->fw_ipnopt) {
   int   _opt_printed = 0;
@@ -321,12 +321,22 @@

   if (!inet_aton(*av,ipno))
    show_usage("ip number\n");
- - -    if (md == ':' && !inet_aton(p,mask))
- - -      show_usage("ip number\n");
- - -    else if (md == '/')
- - -      mask->s_addr = htonl(0xffffffff << (32 - atoi(p)));
- - -    else
- - -      mask->s_addr = htonl(0xffffffff);
+    switch (md) {
+      case ':':
+        if (!inet_aton(p,mask))
+          show_usage("ip number\n");
+        break;
+      case '/':
+        if (atoi(p) == 0) {
+          mask->s_addr = 0;
+        } else {
+          mask->s_addr = htonl(0xffffffff << (32 - atoi(p)));
+        }
+        break;
+      default:
+        mask->s_addr = htonl(0xffffffff);
+        break;
+    }
   av++;
   ac--;
  }
@@ -611,10 +621,9 @@
    break;
   case 'N':
     do_resolv=1;
- - -            break;
- - -          case '?':
- - -           default:
- - -                show_usage(NULL);
+      break;
+    default:
+      show_usage(NULL);
  }

  ac -= optind;
@@ -645,7 +654,7 @@
  } else {
   show_usage(NULL);
  }
- - -        return 0;
+  return 0;
 }

 int


     This one applies to -current:


Index: ipfw.c
===================================================================
RCS file: /home/ncvs/src/sbin/ipfw/ipfw.c,v
retrieving revision 1.26
retrieving revision 1.27
diff -u -r1.26 -r1.27
- - --- ipfw.c  1996/06/18 01:46:34  1.26
+++ ipfw.c  1996/06/23 20:47:51  1.27
@@ -16,7 +16,7 @@
  *
  * NEW command line interface for IP firewall facility
  *
- - - * $Id: ipfw.c,v 1.26 1996/06/18 01:46:34 alex Exp $
+ * $Id: ipfw.c,v 1.27 1996/06/23 20:47:51 alex Exp $
  *
  */

@@ -256,7 +256,7 @@
  }

  if (chain->fw_flg & IP_FW_F_FRAG)
- - -    printf("frag ");
+    printf(" frag ");

  if (chain->fw_ipopt || chain->fw_ipnopt) {
   int   _opt_printed = 0;
@@ -408,12 +408,23 @@

   if (lookup_host(*av,ipno) != 0)
    show_usage("ip number\n");
- - -    if (md == ':' && !inet_aton(p,mask))
- - -      show_usage("ip number\n");
- - -    else if (md == '/')
- - -      mask->s_addr = htonl(0xffffffff << (32 - atoi(p)));
- - -    else
- - -      mask->s_addr = htonl(0xffffffff);
+    switch (md) {
+      case ':':
+        if (!inet_aton(p,mask))
+          show_usage("ip number\n");
+        break;
+      case '/':
+        if (atoi(p) == 0) {
+          mask->s_addr = 0;
+        } else {
+          mask->s_addr = htonl(0xffffffff << (32 - atoi(p)));
+        }
+        break;
+      default:
+        mask->s_addr = htonl(0xffffffff);
+        break;
+    }
+    ipno->s_addr &= mask->s_addr;
   av++;
   ac--;
  }
@@ -788,10 +799,9 @@
    break;
   case 'N':
     do_resolv=1;
- - -            break;
- - -          case '?':
- - -           default:
- - -                show_usage("Unrecognised switch");
+      break;
+    default:
+      show_usage("Unrecognised switch");
  }

  ac -= optind;
@@ -818,7 +828,7 @@
  } else {
   show_usage("Bad arguments");
  }
- - -        return 0;
+  return 0;
 }

 int
=============================================================================
FreeBSD, Inc.

Web Site:      http://www.freebsd.org/
Confidential contacts:    security-officer@freebsd.org
PGP Key:      ftp://freebsd.org/pub/CERT/public_key.asc
Security notifications:    security-notifications@freebsd.org
Security public discussion:  security@freebsd.org

Notice: Any patches in this document may not apply cleanly due to
        modifications caused by digital signature or mailer software.
        Please reference the URL listed at the top of this document
        for original copies of all patches if necessary.

==============================================================================
CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet
is the Dutch network for educational, research and related institutes. CERT-NL
is a member of the Forum of Incident Response and Security Teams (FIRST).

All CERT-NL material is available under:
  http://cert.surfnet.nl/

In case of computer or network security problems please contact your local
CERT/security-team or CERT-NL  (if your institute is NOT a SURFnet customer
please address the appropriate (local) CERT/security-team).

CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer,
i.e. UTC+0100 in winter and UTC+0200 in summer (DST).

   Email:     cert-nl@surfnet.nl     ATTENDED REGULARLY ALL DAYS
   Phone:     +31 302 305 305        BUSINESS HOURS ONLY
   Fax:       +31 302 305 329        BUSINESS HOURS ONLY
   Snailmail: SURFnet bv
              Attn. CERT-NL
              P.O. Box 19035
              NL - 3501 DA  UTRECHT
              The Netherlands

NOODGEVALLEN:    06 22 92 35 64      ALTIJD BEREIKBAAR
EMERGENCIES : +31 6 22 92 35 64      ATTENDED AT ALL TIMES
CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES:
THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED*
PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT
TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU.
===============================================================================

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1i

iQA/AwUBOL6IKTSYjBqwfc9jEQImyACglhSEowgPTfRYe+yzbcm6/MfSSXIAoNPa
JrRyZRB4SPI2/PsBPeu7BiG3
=6CvL
-----END PGP SIGNATURE-----