Vulnerability Note VU#539363

State-based firewalls fail to effectively manage session table resource exhaustion

If new entries are added to the state table more rapidly than the firewall is permitted to remove them, the table will eventually fill to capacity. When this occurs, many firewall implementations will refuse to accept incoming packets that do not match an existing session state. In these implementations, no new connections can be established across the firewall, resulting in a denial of service condition. It is important to note that in some firewall implementations, an attacker can fill the session state table with relatively small amounts of traffic, significantly less than the bandwidth capabilities of the firewall's network interface.

There are several methods that attackers can use to exploit this vulnerability:

TCP SYN Flood

To establish a TCP connection, the client and server must participate in a three-way handshake. The client system begins by sending a SYN message to the server. The server then acknowledges the SYN message by sending SYN-ACK message to the client. The client then finishes establishing the connection by responding with an ACK message. The connection between the client and the server is then open, and the service-specific data can be exchanged between the client and the server. Here is a view of this message flow:

Please see the vendor information section of this document for a list of vendor-specific recommendations for addressing this vulnerability.

The attacks described in this document are difficult to block completely, but there are several improvements that developers can make to reduce their impacts. Several of these techniques are described below:

Use firewall features that detect and block flood traffic

Many firewalls provide features that can detect and block UDP and TCP SYN floods. The CERT/CC recommends that site administrators make use of these features whenever possible.

Use dynamically resizeable state tables

State tables that use dynamically allocated storage can expand to accommodate large numbers of states. This will increase the difficulty of exploiting this vulnerability, but it is important to note that the size of a dynamic state table will still be bounded by a firewall's available memory.

Use separate timeout values for initial sessions

Maintaining separate session timers for initial and established sessions allows state table entries generated by attack traffic to be rapidly removed while still permitting legitimate entries to remain in the state table. Since most attacks rely upon forged IP source addresses from which no reply is expected, attack traffic is unlikely to create state table entries that appear to be established sessions.

Use dynamically adjustable session timers (Aggressive Aging)

As the session time out value decreases, the attacker must increase the traffic rate to ensure that new entries are created faster than the firewall is permitted to remove them. By using dynamic session timers that decrease in response to state table congestion, the firewall can increase its rate of session expiration, making this vulnerability more difficult to exploit.

Allow connection tracking to be disabled

The ability to disable connection tracking for certain protocols would provide administrators with increased flexibility in defending against the attacks described above.

Systems Affected

http://www.qorbit.net/documents/maximizing-firewall-availability.pdf
http://www.uwsg.iu.edu/usail/network/nfs/network_layers.html
http://cr.yp.to/syncookies.html

Credit

The CERT/CC thanks Stephen Gill for his discovery and analysis of this vulnerability.

This document was written by Jeffrey P. Lanza.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.