CVE-2012-2663: High severity netfilter iptables vulnerability
extensions/libxttcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.
Other sources
Originally reported as a DoS related issue:
http://git.kernel.org/?p=linux/kernel/git/davem/net-next.git;a=commitdiff;h=fdf5af0daf8019cec2396cdef8fb042d80fe71fa
Denys Fedoryshchenko reported that SYN+FIN attacks were bringing his linux machines to their limits.
Dont call connrequest() if the TCP flags includes SYN flag
---
This issue also allows bypass of --syn rules in iptables:
http://www.spinics.net/lists/netfilter-devel/msg21248.html
Unfortunately, with current stable Linux kernel release (as well as with most of the previous versions) blocking TCP packets with the SYN bit set and the ACK,RST and FIN bits cleared won't prevent incoming TCP connections.
It should be noted that the combination of SYN+FIN in a TCP-IP packet is generally "illegal" and serves no legitimate purpose.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2663?
CVE-2012-2663 has a medium severity rating due to its potential to allow remote attackers to bypass firewall restrictions.
How do I fix CVE-2012-2663?
To fix CVE-2012-2663, you should upgrade iptables to a version later than 1.4.21 that addresses this vulnerability.
What systems are affected by CVE-2012-2663?
CVE-2012-2663 affects iptables versions up to and including 1.4.21.
What kind of attack does CVE-2012-2663 enable?
CVE-2012-2663 enables remote attackers to bypass intended firewall restrictions using crafted TCP SYN+FIN packets.
Is CVE-2012-2663 still relevant after the CVE-2012-6638 fix?
While CVE-2012-6638 addresses some similar issues, CVE-2012-2663 remains a concern as it specifically pertains to SYN+FIN packet handling in iptables.