Symantec Gateway Security DNS exploit Aug 23 2006 08:02AM
Gianstefano Monni (gianstefano lugnu it) (2 replies)
AW: Symantec Gateway Security DNS exploit Aug 23 2006 05:21PM
Andre Braun (braun andre gmail com)
RE: Symantec Gateway Security DNS exploit Aug 23 2006 04:38PM
Pretorius, Wynand (ZA - Johannesburg) (wpretorius deloitte co za)
Good Evening

DNS in the SGS is using a proxy...If properly configured the sgs will
not allow you to do dns transfers since you specify the source,
interface protocol, leaving interface and destination

-----Original Message-----
From: Gianstefano Monni [mailto:gianstefano (at) lugnu (dot) it [email concealed]]
Sent: 23 August 2006 10:02 AM
To: bugtraq (at) securityfocus (dot) com [email concealed]; ml (at) sikurezza (dot) org [email concealed]
Subject: Symantec Gateway Security DNS exploit

I. THE SYSTEM
Symantec Gateway Security (SGS) is an enterprise-class appliance with a
linux-based stateful inspection firewall and application proxy
capabilities (http/https, ftp, smtp, dns, and so on).
Using the default installation the system keeps listening on the WAN
interface for all its proxies. All the proxies use an authentication
system and everything seems ok. DNS until now can not use authentication
system...

2. THE EXPLOIT
One could connect to the 53/tcp or 53/udp ports of the SGS and use it as
a dns server, for instance to make some "noisy" queries to primary dns
servers (zone transfers, and so on). This could be a problem if,for
instance, those types of queries are logged: in this case the source ip
will be the address of the SGS...

3. THE SOLUTION
A solution could be, for instance, to create a filter (i.e. an iptables
rule) in the SGS to cutoff all the queries coming from outside, taking
into account some particular situation as, for instance, VPNs or DMZs on
the red interface...

--
We reject kings, presidents and voting
We believe in rough consensus and running code IETF Credo

Important Notice: This email is subject to important restrictions, qualifications and disclaimers ("the Disclaimer") that must be accessed and read by visiting our website and viewing the webpage at the following address: http://www.deloitte.com/za/disclaimer. The Disclaimer is deemed to form part of the content of this email in terms of Section 11 of the Electronic Communications and Transactions Act, 25 of 2002. If you cannot access the Disclaimer, please obtain a copy thereof from us by sending an email to ClientServiceCentre (at) Deloitte.co (dot) za. [email concealed]

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus