Vulnerability CVE-2002-1978 - CERT Civis.Net

Vulnerability Name:

CVE-2002-1978 (CCN-10409)

Assigned:

2002-10-17

Published:

2002-10-17

Updated:

2009-04-03

Summary:

IPFilter 3.1.1 through 3.4.28 allows remote attackers to bypass firewall rules by sending a PASV command string as the argument of another command to an FTP server, which generates a response that contains the string, causing IPFilter to treat the response as if it were a legitimate PASV command from the server.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Bypass Security

References:

Source: NETBSD
Type: UNKNOWN
NetBSD-SA2002-024

Source: CCN
Type: IP Filter Web site
What's New for IP Filter

Source: CCN
Type: IPFilter Web site
Download

Source: MITRE
Type: CNA
CVE-2002-1978

Source: CCN
Type: SECTRACK ID: 1005442
IP Filter Linux Firewall Software FTP Proxy Bug Lets Remote Users Bypass the Rule Set

Source: SECTRACK
Type: Patch
1005442

Source: XF
Type: Patch
ip-filter-bypass-firewall(10409)

Source: CCN
Type: US-CERT VU#328867
Multiple vendors` firewalls do not adequately keep state of FTP traffic

Source: CERT-VN
Type: US Government Resource
VU#328867

Source: CCN
Type: OSVDB ID: 4691
IPFilter PASV Command FTP Ruleset Bypass

Source: BID
Type: Patch
6010

Source: CCN
Type: BID-6010
IPFilter FTP Proxy Unauthorized Access Vulnerability

Source: XF
Type: UNKNOWN
ip-filter-bypass-firewall(10409)

Vulnerable Configuration:

Configuration 1:

cpe:/a:darren_reed:ipfilter:3.1.1:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.1.2:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.1.3:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.1.4:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.1.5:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.1.6:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.1.7:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.1.8:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.1.9:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.1.10:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.1:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.2:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.3:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.4:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.5:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.6:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.7:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.8:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.9:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.10:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.11:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.12:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.13:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.14:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.15:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.16:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.17:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.18:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.19:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.20:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.21:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.2.22:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.1:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.2:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.3:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.4:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.5:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.6:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.7:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.8:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.9:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.10:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.11:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.12:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.13:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.14:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.15:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.16:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.17:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.18:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.19:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.20:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.21:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.3.22:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.1:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.2:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.3:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.4:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.5:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.6:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.7:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.8:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.9:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.10:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.11:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.12:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.13:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.14:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.15:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.16:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.17:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.18:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.19:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.20:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.21:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.22:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.23:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.24:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.25:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.26:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.27:*:*:*:*:*:*:*

OR cpe:/a:darren_reed:ipfilter:3.4.28:*:*:*:*:*:*:*

Denotes that component is vulnerable