Shorewall 2.4.x before 2.4.1, 2.2.x before 2.2.5, and 2.0.x before 2.0.17, when MACLIST_TTL is greater than 0 or MACLIST_DISPOSITION is set to ACCEPT, allows remote attackers with an accepted MAC address to bypass other firewall rules or policies.

A firewall bypass vulnerability has been found in shorewall. If MACLIST_TTL was set to a value greater than 0 or MACLIST_DISPOSITION was set to 'ACCEPT' in /etc/shorewall/shorewall.conf, and a client was positively identified through its MAC address, that client bypassed all other policies/rules in place. This could allow external computers to get access to ports that are intended to be restricted by the firewall policy.

Please note that this does not affect the default configuration, which does not enable MAC based client identification.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

'Supernaut' noticed that shorewall, the Shoreline Firewall, could generate an iptables configuration which is significantly more permissive than the rule set given in the shorewall configuration, if MAC verification are used in a non-default manner.

When MACLIST_DISPOSITION is set to ACCEPT in the shorewall.conf file, all packets from hosts which fail the MAC verification pass through the firewall, without further checks. When MACLIST_TTL is set to a non-zero value, packets from hosts which pass the MAC verification pass through the firewall, again without further checks.

The remote host is affected by the vulnerability described in GLSA-200507-20 (Shorewall: Security policy bypass)

    Shorewall fails to enforce security policies if configured with     'MACLIST_DISPOSITION' set to 'ACCEPT' or 'MACLIST_TTL' set to a value     greater or equal to 0.
  Impact :

    A client authenticated by MAC address filtering could bypass all     security policies, possibly allowing him to gain access to restricted     services. The default installation has MACLIST_DISPOSITION=REJECT and     MACLIST_TTL=(blank) (equivalent to 0). This can be checked by looking     at the settings in /etc/shorewall/shorewall.conf   Workaround :

    Set 'MACLIST_TTL' to '0' and 'MACLIST_DISPOSITION' to 'REJECT' in the     Shorewall configuration file (usually /etc/shorewall/shorewall.conf).

A vulnerability was discovered in all versions of shorewall where a client accepted by MAC address filtering is able to bypass any other rule. If MACLIST_TTL is set to a value greater than 0 or MACLIST_DISPOSITION is set to ACCEPT in shorewall.conf, and a client is positively identified through its MAC address, it bypasses all other policies and rules in place, gaining access to all open services on the firewall.

Shorewall 2.0.17 is provided which fixes this issue.

ID	Name	Product	Family	Severity
20611	Ubuntu 4.10 / 5.04 : shorewall vulnerability (USN-197-1)	Nessus	Ubuntu Local Security Checks	high
19957	Debian DSA-849-1 : shorewall - programming error	Nessus	Debian Local Security Checks	high
19282	GLSA-200507-20 : Shorewall: Security policy bypass	Nessus	Gentoo Local Security Checks	high
19267	Mandrake Linux Security Advisory : shorewall (MDKSA-2005:123)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2005-2317

high

Tenable Plugins

high

high

high

high