Project

General

Profile

Actions
Copy link

Bug #13918

open

ICMP timestamp requests are passed by states created from ICMP echo requests if they use the same ID

Added by Marcos M almost 2 years ago. Updated almost 2 years ago.

Status:
New
Priority:
Low
Assignee:
Reid Linnemann
Category:
Operating System
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

ICMP timestamp requests with the same identifier of a previously allowed ICMP echo request are also allowed. This is due to the ICMP timestamp request matching the ICMP echo request state that exists.

This issue seems to have existed for some time:
https://marc.info/?l=openbsd-tech&m=117487638116535
https://nvd.nist.gov/vuln/detail/CVE-1999-0524

Test:
  1. Create a rule on the firewall allowing ICMP echo requests, then another blocking all ICMP:
    pass in quick on $ADMIN inet proto icmp from any to any icmp-type echoreq ridentifier 1675111483 keep state label "USER_RULE" label "id:1675111483"
    block in quick on $ADMIN inet proto icmp from any to any ridentifier 1675111494 label "USER_RULE" label "id:1675111494"
  2. Using nping, send an echo request with a specified ID, then send the timestamp request:
    nping --icmp --icmp-id 19397 10.0.5.1
    nping --icmp --icmp-type 13 --icmp-id 19397 10.0.5.1

Related issues

Related to Bug #13652: Inconsistent behavior filtering ICMP trafficClosed

Actions
Actions
Copy link

Also available in: Atom PDF