A Shorewall update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200507-20
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: Shorewall: Security policy bypass
Date: July 22, 2005
Bugs: #99398
ID: 200507-20

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

A vulnerability in Shorewall allows clients authenticated by MAC address filtering to bypass all other security rules.



Background
=========

Shorewall is a high level tool for configuring Netfilter, the firewall facility included in the Linux Kernel.

Affected packages
================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-firewall/shorewall < 2.4.1 *>= 2.2.5
>= 2.4.1

Description
==========

Shorewall fails to enforce security policies if configured with "MACLIST_DISPOSITION" set to "ACCEPT" or "MACLIST_TTL" set to a value greater or equal to 0.

Impact
=====

A client authenticated by MAC address filtering could bypass all security policies, possibly allowing him to gain access to restricted services.

Workaround
=========

Set "MACLIST_TTL" to "0" and "MACLIST_DISPOSITION" to "REJECT" in the Shorewall configuration file (usually /etc/shorewall/shorewall.conf).

Resolution
=========

All Shorewall users should upgrade to the latest available version:

# emerge --sync
# emerge --ask --oneshot --verbose net-firewall/shorewall

References
=========

[ 1 ] CAN-2005-2317
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2317
[ 2 ] Shorewall Announcement
http://www.shorewall.net/News.htm#20050717

Availability
===========

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200507-20.xml

Concerns?
========

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.

License
======

Copyright 2005 Gentoo Foundation, Inc; referenced text belongs to its owner(s).

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0