Re: [Full-Disclosure] A new TCP/IP blind data injection technique?

On Mon, 15 Dec 2003, Michael Gale wrote:

> Well first of all, one of the industry leading firewalls ( BorderWare
> Firewall Server ) does NOT pass fragmented packets.

What I was asking for, is whether you have any further information about
this? Or is it just the way you have it configured? I would be surprised
if this is a default for commercial production-grade firewalls, as it may
- quite simply - prevent some people from communicating with you in some
situations. Most commercial firewall vendors go as far as disabling PMTUD
just to avoid this.

> I have a rule at the beginning: iptables -A INPUT -f -j DROP

Ok - this is a very specific configuration, then. On most sane firewalls,
it is not necessary to drop fragments (and, quite frankly, not
particularly wise, either) - the firewall will simply reassemble all
traffic before forwarding it any further (this is something you suggested
is going to be implemented for BorderWare, and a functionality present for
long years on systems like Linux)..

Cheers,

-- 
------------------------- bash$ :(){ :|:&};: --
 Michal Zalewski * [http://lcamtuf.coredump.cx]
    Did you know that clones never use mirrors?
--------------------------- 2003-12-15 19:05 --
   http://lcamtuf.coredump.cx/photo/current/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html