CVE-2000-0553: Race Condition
Race condition in IPFilter firewall 3.4.3 and earlier, when configured with overlapping "return-rst" and "keep state" rules, allows remote attackers to bypass access restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the IPFilter ruleset so that 'return-rst' rules do not overlap with 'keep state' rules. Remove, narrow, or reorder rules (addresses, masks, ports, or match criteria) so a given packet cannot match both a 'return-rst' and a 'keep state' rule; then apply the updated ruleset.
Phildev IPFilter rule overlap: 'return-rst' vs 'keep state' = no-overlap / do not configure overlapping return-rst and keep state rules - Operational
Audit existing IPFilter configurations for overlapping 'return-rst' and 'keep state' rules, implement the configuration changes above, and verify that access restrictions behave as intended by testing blocked/allowed traffic. Record the changes and monitor logs for any signs of bypass.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0553?
CVE-2000-0553 is considered to have a high severity due to the potential for remote attackers to bypass access restrictions.
How do I fix CVE-2000-0553?
To fix CVE-2000-0553, you should upgrade to a version of IPFilter that does not contain this vulnerability, specifically versions later than 3.4.3.
What causes the vulnerability CVE-2000-0553?
CVE-2000-0553 is caused by a race condition in IPFilter when using conflicting "return-rst" and "keep state" rules.
Who is affected by CVE-2000-0553?
CVE-2000-0553 affects users of IPFilter versions 3.4.3 and earlier deployed in configurations with overlapping rules.
Can CVE-2000-0553 be exploited remotely?
Yes, CVE-2000-0553 can be exploited remotely, allowing attackers to bypass firewall access restrictions.