|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
|
Clavister Information for VU#222750
| Date Notified: | 2004-08-12 |
| Date Updated: | |
| Statement Date: | |
| Status Summary: | Not Vulnerable |
Vendor StatementClavister Firewall is itself not vulnerable to this class of attacks. It also attempts to protect clients against such attacks.
Specifically:
- No ICMP errors are passed by default. They may however be allowed on a per-rule/service basis.
- The firewall's own TCP stack (used by internal processes and ALGs) does not listen ICMP errors at all.
- All sequence numbers are scrambled using a high quality random engine, making sequence number guessing harder.
- In the case of many-to-one (dynamic) NAT, source port numbers are allocated randomly, making source port number guessing harder. See draft-gont-tcpm-icmp-attacks-00 section 5.3
- On not accepting ICMP errors: The method outlined in draft-gont-tcpm-icmp-attacks-00 section 5.2 (delaying the connection reset) results in behavior not too dissimilar. The difference simply lies in how many packets that get sent before the connection is failed.
- PMTU discovery problems that normally arise by not accepting ICMP errors by default are avoided by doing DF bit stripping by default.
Vendor InformationThe vendor has not provided us with any further information regarding this vulnerability.
AddendumUS-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
 |
