Exploit-DB #232
Description: Check Point VPN-1/FireWall-1 4.1 SP2 - Blocked Port Bypass
Type: remote
Platform: windows
Date: 2000-12-19
Author: anonymous

Exploit:
/*

  Summary
  A vulnerability exists in Check Point VPN-1/FireWall-1 4.1 SP2 that enables
  an attacker to establish connections to blocked TCP services through the
  firewall in certain configurations. 

  We expect many deployed FireWall-1 installations to be immune to this attack.
  But we think that the beauty inherent to the applied exploit technique would
  justify an advisory by itself. 

  Fix Information
  Workaround
  Disable the Fastmode property for all protocols.

  Note: Fastmode is disabled by default, and is enabled only if the firewall
        administrator has specifically changed the TCP property for a protocol.
        To verify this setting, select a protocol from the "Manage->Services"
        menu in the Policy Editor by double-clicking on the protocol or clicking
        the "Edit" button. Make sure the "FastMode" box at the bottom of the TCP
        Service Properties window is not checked.

  Disabling Fastmode removes all known vulnerabilities.

  Official Fix
  This vulnerability is fixed in VPN-1/FireWall-1 4.1 SP3, which is available now.

  Thanks
  We would like to thank Check Point Software Technologies Ltd. for their quick
  and competent response to this problem and their co-operation on this advisory.
  We would also like to thank John McDonald and Dug Song for inspiration on the
  idea of adding invalid IP options to datagrams.

  Impact
  In a nutshell
  If we use Fastmode and allow access to a single TCP service, all TCP services
  on the same machine become accessible. In addition, all TCP services on machines
  that are at least one hop away from the firewall become accessible, too, if these
  machines are located behind the same firewall interface as the machine mentioned
  above.

  That means, for example, that once you open a service in your DMZ to the Internet,
  all services in the DMZ may become accessible to the Internet. And once you open
  a service in your intranet to the DMZ (suppose the web server needs to access a
  DBMS or the mail server has to forward mail to the intranet), all services in the
  intranet may become accessible to the DMZ.

  Thus, an attacker might be able to work his way from the Internet through the
  DMZ to the intranet.

  Depending on your topology, this problem can be harmless or fatal.

  In full detail
  Connections to arbitrary TCP services at an IP address X can be established, if 
  1) at least one service in the rulebase is a Fastmode service 
  AND

  2) either of the following two conditions is satisfied.

  2.1) The rulebase grants the attacker legitimate access to at least one TCP
       service at address X. 
  OR

  2.2) The following three conditions are satisfied.

  2.2.a) The rulebase grants the attacker legitimate access to at least one TCP
          service at an arbitrary address Y 
  AND

  2.2.b) address X is at least one hop away from the firewall 
  AND


  2.2.c) address X is located behind the same firewall interface as address Y. 
  Details
  As we know, if a certain service is defined to be a Fastmode service, then all
  non-SYN packets with a source or destination port equal to the Fastmode service
  will be accepted by the firewall. Only SYN packets are still passed through the
  inspection engine.
  Version 4.1 SP2 does not include a minimal length check for the first fragment
  of a TCP packet anymore. Instead, when examining TCP ports and TCP flags, it
  copies the TCP header from the linked list of fragments to a contiguous memory
  buffer. Thus, if we fragment the 20 byte TCP header into three 8 byte + 8 byte
  + 4 byte fragments, FW-1 will still interpret the TCP header correctly. This
  is the major difference to prior versions. In prior versions, the inspection
  engine made sure that the first fragment had a length of at least 40 bytes and
  then performed the rulebase checks (TCP ports, TCP flags) directly in the mbuf
  of the first fragment. No copying.

  What can we do with this? As stated above, the attack needs two things in order
  to succeed: a) a Fastmode service and b) an open port at a certain IP address.
  Let us assume that we have a web server with port 80 open to the public. Suppose
  that the administrator has made port 80 a Fastmode service, in order to improve
  firewall performance.

  We now send two fragmented TCP packets, packet A and packet B. Fragment #1 of
  these packets contains the first 8 bytes of the respective TCP header, fragment
  #2 contains the next 8 bytes, and fragment #3 contains the remaining 4 bytes.

  Packet A is an ACK packet with a source port equal to the Fastmode service,
  i.e. a source port of 80. The destination port of this packet is the blocked
  service that we want to get a SYN to. Let us assume it is 32775. Suppose A1,
  A2 and A3 are the three fragments of packet A. They now contain the following
  information.

  A1: ports (80 -> 32775)
  A2: flags (ACK)
  A3: ...

  This packet will be accepted, because the source port is a Fastmode service
  and it is not a SYN packet.

  Packet B is a SYN packet with a non-privileged source port, e.g. 1024. The
  destination port of this packet is the service which is open to the outside
  world, i.e. 80. So, the fragments of packet B contain the following
  information.

  B1: ports (1024 -> 80)
  B2: flags (SYN)
  B3: ...

  This fragment will be accepted, because it is accepted by the rulebase.

  For both fragment sets we choose the same IP id. And what we want to end
  up with is that the destination host of the fragments drops A2, B1, and
  B3. Because then the firewall will accept two harmless packets that will
  be combined into a single not so harmless packet at the destination, as in

  A1: ports (80 -> 32775)
  B2: flags (SYN)
  A3: ...

  So, we have to somehow malform A2, B1, and B3. However, the fragments must
  not be malformed when