From owner-freebsd-security@freebsd.org Sun Dec 8 20:37:45 2019 Return-Path: Delivered-To: freebsd-security@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id F3A411B87BC for ; Sun, 8 Dec 2019 20:37:45 +0000 (UTC) (envelope-from SRS0=D8gP=Z6=quip.cz=000.fbsd@elsa.codelab.cz) Received: from elsa.codelab.cz (elsa.codelab.cz [94.124.105.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 47WJ6c4vq7z3L27 for ; Sun, 8 Dec 2019 20:37:44 +0000 (UTC) (envelope-from SRS0=D8gP=Z6=quip.cz=000.fbsd@elsa.codelab.cz) Received: from elsa.codelab.cz (localhost [127.0.0.1]) by elsa.codelab.cz (Postfix) with ESMTP id BE2D82840C; Sun, 8 Dec 2019 21:37:41 +0100 (CET) Received: from illbsd.quip.test (ip-62-24-92-232.net.upcbroadband.cz [62.24.92.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by elsa.codelab.cz (Postfix) with ESMTPSA id CCE6028411; Sun, 8 Dec 2019 21:37:39 +0100 (CET) Subject: Re: New Linux vulnerability lets attackers hijack VPN connections To: Eugene Grosbein , freebsd-security@freebsd.org References: <6b02b7b8-c40d-93d0-319d-15dcf8ac9fd5@quip.cz> <55670520-3f6d-2674-bb05-08e78d4d92da@grosbein.net> From: Miroslav Lachman <000.fbsd@quip.cz> Message-ID: Date: Sun, 8 Dec 2019 21:37:38 +0100 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:52.0) Gecko/20100101 Firefox/52.0 SeaMonkey/2.49.3 MIME-Version: 1.0 In-Reply-To: <55670520-3f6d-2674-bb05-08e78d4d92da@grosbein.net> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: 47WJ6c4vq7z3L27 X-Spamd-Bar: +++ Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=none (mx1.freebsd.org: domain of SRS0=D8gP=Z6=quip.cz=000.fbsd@elsa.codelab.cz has no SPF policy when checking 94.124.105.4) smtp.mailfrom=SRS0=D8gP=Z6=quip.cz=000.fbsd@elsa.codelab.cz X-Spamd-Result: default: False [3.95 / 15.00]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; IP_SCORE(0.88)[ip: (0.38), ipnet: 94.124.104.0/21(0.19), asn: 42000(3.73), country: CZ(0.09)]; MIME_GOOD(-0.10)[text/plain]; RCVD_TLS_LAST(0.00)[]; DMARC_NA(0.00)[quip.cz]; AUTH_NA(1.00)[]; NEURAL_SPAM_MEDIUM(0.88)[0.885,0]; RCVD_COUNT_THREE(0.00)[3]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; RCVD_IN_DNSWL_NONE(0.00)[4.105.124.94.list.dnswl.org : 127.0.10.0]; NEURAL_SPAM_LONG(0.99)[0.988,0]; R_SPF_NA(0.00)[]; FORGED_SENDER(0.30)[000.fbsd@quip.cz,SRS0=D8gP=Z6=quip.cz=000.fbsd@elsa.codelab.cz]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:42000, ipnet:94.124.104.0/21, country:CZ]; FROM_NEQ_ENVFROM(0.00)[000.fbsd@quip.cz,SRS0=D8gP=Z6=quip.cz=000.fbsd@elsa.codelab.cz]; MID_RHS_MATCH_FROM(0.00)[] X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 08 Dec 2019 20:37:46 -0000 Eugene Grosbein wrote on 2019/12/08 12:33: > 08.12.2019 16:25, Miroslav Lachman wrote: > >> https://www.bleepingcomputer.com/news/security/new-linux-vulnerability-lets-attackers-hijack-vpn-connections/ >> >> Security researchers found a new vulnerability allowing potential attackers to hijack VPN connections on affected *NIX devices and inject arbitrary data payloads into IPv4 and IPv6 TCP streams. >> >> They disclosed the security flaw tracked as CVE-2019-14899 to distros and the Linux kernel security team, as well as to others impacted such as Systemd, Google, Apple, OpenVPN, and WireGuard. >> >> The vulnerability is known to impact most Linux distributions and Unix-like operating systems including FreeBSD, OpenBSD, macOS, iOS, and Android. >> >> Attacks exploiting CVE-2019-14899 work against OpenVPN, WireGuard, and IKEv2/IPSec, but the researchers are still testing their feasibility against Tor. >> >> https://seclists.org/oss-sec/2019/q4/122 > > Why do these "researchers" call it "new"? There is nothing new in lack of standard anti-spoofing filtering > for network interfaces of any kind, be it tunnels or not. > > Our /etc/rc.firewall has "Stop spoofing" configuration by phk@ since first revision committed in 1996. > Our gif(4) interface has built-in anti-spoofing feature enabled by default, too. They need to hype it a bit. It sounds more urgent than "old vulnerability". And partly because it is new to some Linux distributions where some antispoof settings were turned off. cite: We see that the default settings in sysctl.d/50-default.conf in the systemd repository were changed from “strict” to “loose” mode on November 28, 2018, so distributions using a version of systemd without modified configurations after this date are now vulnerable. Miroslav Lachman