From owner-freebsd-ipfw Thu Feb 28 8: 2: 8 2002 Delivered-To: freebsd-ipfw@freebsd.org Received: from rwcrmhc52.attbi.com (rwcrmhc52.attbi.com [216.148.227.88]) by hub.freebsd.org (Postfix) with ESMTP id 77A1F37B400 for ; Thu, 28 Feb 2002 08:02:04 -0800 (PST) Received: from blossom.cjclark.org ([12.234.91.48]) by rwcrmhc52.attbi.com (InterMail vM.4.01.03.27 201-229-121-127-20010626) with ESMTP id <20020228160204.XXVK1147.rwcrmhc52.attbi.com@blossom.cjclark.org>; Thu, 28 Feb 2002 16:02:04 +0000 Received: (from cjc@localhost) by blossom.cjclark.org (8.11.6/8.11.6) id g1SG23j68962; Thu, 28 Feb 2002 08:02:03 -0800 (PST) (envelope-from cjc) Date: Thu, 28 Feb 2002 08:02:03 -0800 From: "Crist J. Clark" To: "Adam@junik.lv" Cc: freebsd-ipfw@FreeBSD.ORG Subject: Re: pass tcp from any to any established Message-ID: <20020228080202.H66092@blossom.cjclark.org> References: <174101c1c034$87303380$03cdb6d5@junik.lv> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <174101c1c034$87303380$03cdb6d5@junik.lv>; from adam@junik.lv on Thu, Feb 28, 2002 at 10:47:17AM +0200 X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-ipfw@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Thu, Feb 28, 2002 at 10:47:17AM +0200, Adam@junik.lv wrote: > Hi, > I would really appreciate it if you could cast some light upon this issue: > > Is it at all possible that the ipfw rule: > ipfw add pass tcp from any to any established > can be abused by intruders? The first think that comes to mind is an ACK (or SYN-ACK) or FIN scan. It's as easy as the '-sA' and '-sF' options in nmap(1). -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message