Symantec Raptor Firewall Access Arbitrary TCP Port via HTTP

2001-03-24T10:55:29
ID OSVDB:4697
Type osvdb
Reporter Lysel Christian Emre(chlys@wimdata.com)
Modified 2001-03-24T10:55:29

Description

Vulnerability Description

Symantec Raptor Firewall contains a flaw that may allow a remote attacker to bypass firewall policies. The issue is triggered when the "http.noproxy" rule is not set and clients are configured to use the nearest interface of the firewall as a proxy. It is possible that the flaw may allow a remote attacker to send HTTP requests to the firewall to access any system with TCP ports 79-99 and 200-65535 (except port 80) resulting in a loss of confidentiality.

Solution Description

Currently, there are no known workarounds or upgrades to correct this issue. However, Symantec has released a patch to address this vulnerability.

Short Description

Symantec Raptor Firewall contains a flaw that may allow a remote attacker to bypass firewall policies. The issue is triggered when the "http.noproxy" rule is not set and clients are configured to use the nearest interface of the firewall as a proxy. It is possible that the flaw may allow a remote attacker to send HTTP requests to the firewall to access any system with TCP ports 79-99 and 200-65535 (except port 80) resulting in a loss of confidentiality.

References:

Vendor URL: http://www.symantec.com/index.htm Vendor Specific Solution URL: ftp://ftp.axent.com/public/english_international/products/raptor_firewall/nt/6.5/updates/httpd-des.zip Security Tracker: 1001153 Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2001-03/0359.html ISS X-Force ID: 6313 CVE-2001-0483 Bugtraq ID: 2517