Overview
The default configuration of the IP Masquerade feature of certain Linux 2.2 kernels may allow unsolicited inbound UDP packets to traverse a NAT gateway and reach a translated network.
Description
As defined in RFC 1631, Network Address Translation (NAT) provides a means to translate a local networks' IP addresses in to globally unique addresses. NAT operates on the assumption that not all of the hosts on a local network need to communicate beyond the local network at the same time. Traditional NAT and Port Address Translation (NAPT or PAT) can map many local addresses to fewer global addresses (possibly just one address), thus reducing the overall need for unique global IPv4 addresses, improving portability, and providing some modest security through the use of RFC 1918 private address space that is not globally routed. IP Masquerade is a kernel implementation of NAT on Linux. Based on code obtained from The Linux Kernel Archives, IP Masquerade is configured by default to handle UDP translations using "destination loose" (DLOOSE) behavior in kernel versions 2.2.0-pre5 through 2.2.14. This is indicated in ip_masq.c by the presence of the preprocessor directive |
Impact
An attacker could send arbitrary UDP packets to a network behind a vulnerable NAT gateway. |
Solution
The following information is based on Linux kernel code from The Linux Kernel Archives. Individual distributions may have different default configurations. |
Upgrade to Linux kernel version 2.4 or above that incorporates netfilter/iptables. |
Vendor Information
CVSS Metrics
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
References
- http://www.securityfocus.com/bid/1078
- http://www.securitybugware.org/Linux/692.html
- http://www.suse.com/de/support/security/suse_security_announce_48.txt
- http://www.ietf.org/html.charters/nat-charter.html
- http://www.ietf.org/rfc/rfc1123.txt
- http://www.ietf.org/rfc/rfc1631.txt
- http://www.ietf.org/rfc/rfc2663.txt
- http://www.ietf.org/rfc/rfc2993.txt
- http://www.ietf.org/rfc/rfc3235.txt
Acknowledgements
The CERT Coordination Center acknowledges H. D. Moore for reporting this issue.
This document was written by Art Manion.
Other Information
CVE IDs: | CVE-2000-0289 |
Severity Metric: | 2.65 |
Date Public: | 2000-03-27 |
Date First Published: | 2002-04-02 |
Date Last Updated: | 2008-05-06 20:47 UTC |
Document Revision: | 48 |