CVE-2001-1387: Infoleak

Q: What access or conditions are needed to exploit this issue?

The issue has a local attack vector and requires low attack complexity with no authentication. Exploitation depends on an administrator saving and later relying on a rule using "--reject-with icmp-host-prohibited."

Q: How can I determine whether a saved ruleset is affected?

Inspect rulesets produced by iptables-save for reject rules originally configured with "--reject-with icmp-host-prohibited." An affected version records that rule as "--reject-with tcp-reset" instead.

Q: What is the practical impact of the incorrect saved rule?

When the saved ruleset is used, iptables generates TCP reset responses instead of ICMP host-prohibited responses. This behavioral difference may disclose information.

Published Nov 5, 2001

Updated

iptables-save in iptables before 1.2.4 records the "--reject-with icmp-host-prohibited" rule as "--reject-with tcp-reset," which causes iptables to generate different responses than specified by the administrator, possibly leading to an information leak.

Affected Software

1 affected component

netfilter iptables<1.2.4

Event History

Nov 5, 2001

CVE Published

05:00 AM

Aug 31, 2002

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What access or conditions are needed to exploit this issue?

The issue has a local attack vector and requires low attack complexity with no authentication. Exploitation depends on an administrator saving and later relying on a rule using "--reject-with icmp-host-prohibited."

How can I determine whether a saved ruleset is affected?

Inspect rulesets produced by iptables-save for reject rules originally configured with "--reject-with icmp-host-prohibited." An affected version records that rule as "--reject-with tcp-reset" instead.

What is the practical impact of the incorrect saved rule?

When the saved ruleset is used, iptables generates TCP reset responses instead of ICMP host-prohibited responses. This behavioral difference may disclose information.

CVE-2001-1387: Infoleak

Affected Software

Event History

Frequently Asked Questions

What access or conditions are needed to exploit this issue?

How can I determine whether a saved ruleset is affected?

What is the practical impact of the incorrect saved rule?

Company

Resources

Contact

Frequently Asked Questions

What access or conditions are needed to exploit this issue?

How can I determine whether a saved ruleset is affected?

What is the practical impact of the incorrect saved rule?