ID

11580

Nom

UDP packets with source port of 53 bypass firewall rules

Auteurs

This script is Copyright (C) 2003-2007 Tenable Network Security

Catégorie

Firewalls

Action

attack

Résumé

By-passes the remote firewall rules

Description

It is possible to by-pass the rules of the remote firewall by sending UDP packets with a source port equal to 53. An attacker may use this flaw to inject UDP packets to the remote hosts, in spite of the presence of a firewall. Solution : Review your firewall rules policy Risk factor : High

UDP packets with source port of 53 bypass firewall rules
Gopherd Proxy Usage
ZoneAlarm Personal Firewall port 67 flaw
RADIUS server detection
ICMP Netmask Request
Arkoon identification
L2TP detection
Check Point FireWall-1 ICA Service Detection
Weak Initial Sequence Number
NetAsq identification
BenHur Firewall active FTP firewall leak
Default password (zebra) for Zebra
Firewall Enabled
Proxy accepts POST requests
Finjan restart command
Check Point FireWall-1 Telnet Client Authentication Detection
Open Web Proxy Server
Usable remote proxy on any port
CCProxy Detection
Checkpoint FW-1 identification
Checkpoint Firewall open Web administration
Proxy accepts CONNECT requests
Check Point FireWall-1 HTTP Client Authentication Detection
Kerio WinRoute Firewall HTTP/HTTPS Management Detection
ICMP Timestamp Request
Kerio personal Firewall buffer overflow
StoneGate client authentication detection
IBM Tivoli Relay Overflow
BlueCoat ProxySG console management detection
Remote host on same physical but not logical network
Proxy accepts gopher:// requests
ZoneAlarm Pro local DoS
ZoneAlarm Local Privilege Escalation Vulnerability
Passwordless Wingate installed
Remote host replies to SYN+FIN
Raptor FW version 6.5 detection
Source routed packets