TCP Handshake Exploit Defense

[dubbsix]

Read an article on Networkworld.com about TCP split handshake vulnerabilities in most firewalls, including the Fortinet Fortigate. FYI here is the NW article: http://www.networkworld.com/news/2011/041211-hacker-exploit-firewalls.html?page=1 wonder if there was any development on a workaround for this. If anyone would like to research the exploit and test against some mitigation steps in the fortios code let me know :)

[BrianPro]

I' ve only seen this response from Fortinet: http://blog.fortinet.com/fortinet-responds-to-nss-labs-public-firewall-test/ The workaround is to enable IPS (if available). If not it seems you are open to the attack for now. I think this article gives a bit more info about the issues: http://www.networkcomputing.com/wan-security/three-firewalls-flunk-stability-tests-nss-labs-reports.php Personally, I think the response from Fortinet it is a bit of a side step. This needs to be fixed ASAP. It looks like they are planning a patch for both MR2 and MR3 to address. What *is* concerning is that #1 it existed in a product made by a security focused firm, #2 from the article and statements by NSS the exploit was ignored when disclosed privately to Fortinet over a month ago, #3 that fact that the firewall fell down under the load and then rebooted itself allowing root access via SSH (NSS doesn' t disclose how in detail).

[dubbsix]

BrianPro, I agree with you. Its a bit concerning that Fortinet as a security fendor would not build a device that failed in a secure fashion. I guess its pretty easy to assume they are not EAL certified :p All jokes aside, it seems Fortinet is not the only security vendor that failed this test. Wish i had the 3500 smackers for the report though :\

[ejhardin]

Per the article... " Fortinet developed new IPS signatures to explicitly block the handshake, which are available today to all customers." Does anyone know what the name of the IPS signature?

[Phuoc_Ngo]

#3 that fact that the firewall fell down under the load and then rebooted itself allowing root access via SSH (NSS doesn' t

This is a serious threat that need serious attention from Fortinet. With the half baked IPS and AV, will not be able to stop persistent attack. Hope they will address the issue sooner. Phuocngo

[billp]

The SSH exploit sounds like it' s patched now per the article. The were using 4 MR2 P1. In any event, not good news. However, given the publicity this is getting, you can be certain all these issues will be addressed asap in a May firmware release. There is probably a fair amount of fire in engineering right now since this could directly affect sales. Probably not a lot of vacation time getting granted right now

[edsouza_FTNT]

You can try to enable IPS rule: " TCP.Stealth.Activity" . I think it' s disabled by default. More details here: http://www.fortiguard.com/encyclopedia/vulnerability/tcp.stealth.activity.html From what I know, it will prevent the TCP split handshake from setting up.

[ejhardin]

You can try to enable IPS rule: " TCP.Stealth.Activity" . I think it' s disabled by default.

The statement from Fortinet has me to believe that they have created a new IPS signature that was pushed out to all customers yesterday. My question is what is the IPS signature? I only ask because I want to call Fortinet' s bluff. The " TCP.Stealth.Activity" is from 2006 and not yesterday. Also my second point... I want to know which signature because I' m 99% sure that it is not enabled by default which means that it will not log on this new attack and will not protect you as Fortinet has stated in the article.

[BrianPro]

The statement from Fortinet has me to believe that they have created a new IPS signature that was pushed out to all customers yesterday. My question is what is the IPS signature? I only ask because I want to call Fortinet' s bluff. The " TCP.Stealth.Activity" is from 2006 and not yesterday. Also my second point... I want to know which signature because I' m 99% sure that it is not enabled by default which means that it will not log on this new attack and will not protect you as Fortinet has stated in the article.

Yes, Fortinet should be a little more up front about this and state when it will be available, what version of the IPS sig/definition and how to enable it (if not on by default) *now*. Beside the fact that (IMO) relying on the IPS is a bit of a cop out anyway. I' d also expect them to release a definite date on the firmware patch (or at least a decent estimate) considering the severity of the issue.

[Phuoc_Ngo]

Like ejhardin stated, the signature is disable by default and this signature had been there since 2006. This signature is definitively does not get release yesterday.