The question is - is this feature (src port randomization) enabled by default?
On Thu, Jul 10, 2008 at 9:00 AM, Deniz Cevik <[EMAIL PROTECTED]> wrote: > Yes, enable this feature at see what will happen. This check sometimes > drop valid dns request. > > > ------------------------------ > > *From:* [EMAIL PROTECTED] [mailto: > [EMAIL PROTECTED] *On Behalf Of *Ray P > *Sent:* Thursday, July 10, 2008 4:35 AM > *To:* imipak; Full Disclosure > *Subject:* Re: [Full-disclosure] DNS and Checkpoint > > > > The article you're looking at is for their SmartDefense product, an add-in > to Firewall-1. Supposedly it will protect a DNS server behind the firewall > from this vulnerability. > > Ray > > > Date: Wed, 9 Jul 2008 15:00:39 +0100 > > From: [EMAIL PROTECTED] > > To: [email protected] > > Subject: [Full-disclosure] DNS and Checkpoint > > > > Hello everyone, > > > > I've had a report from someone with clue (and tcpdump) that a properly > > functioning DNS resolver that correctly uses randomised source ports > > magically becomes vulnerable once the traffic's passed through a > > Checkpoint firewall, where Dan Kaminsky's tool shows: > > > > x.y.z.155:56978 TXID=712 > > x.y.z.155:56979 TXID=45713 > > x.y.z.155:56980 TXID=63532 > > x.y.z.155:56981 TXID=7243 > > x.y.z.155:56982 TXID=17620 > > > > (note the incrementing port numbers.) > > > > Can anyone else confirm this behaviour? > > > > Checkpoint are one of the dozens of vendors listed on the CERT > > advisory as "Status: Unknown" > > http://www.kb.cert.org/vuls/id/MIMG-7ECL6B > > > > They do have an advisory up: > > > http://www.checkpoint.com/defense/advisories/public/2008/cpai-01-Jul.html > > > > I don't have the login needed to read the whole thing, but the front > > page just says: > > > > "Protection provided by: > > VPN-1: * NGX R65 > > * NGX R62 > > * NGX R61 > > * NGX R60 > > [...etc, etc...] " > > > > > > cheers > > > > =i > > > > _______________________________________________ > > Full-Disclosure - We believe in it. > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > > Hosted and sponsored by Secunia - http://secunia.com/ > ------------------------------ > > Need to know now? Get instant answers with Windows Live Messenger. IM on > your > terms.<http://www.windowslive.com/messenger/connect_your_way.html?ocid=TXT_TAGLM_WL_messenger_072008> > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
