bugtraq - RE: SonicWall Firewall DoS, ARP Flood, Network Mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 3 Mar 2004 16:16:37 -0600
From: "Robert C. Auch" <RAuch@...alnetsolutions.net>
To: <bugtraq@...urityfocus.org>
Subject: RE: SonicWall Firewall DoS, ARP Flood, Network Mapping

A few clarifications, according to CSSA Support (Level 2 support):

1) You need to have Ethernet connectivity to the WAN interface to
exploit this.  T1, and many cable implementations will stop this.

2) The "default" or "normal" mode that most SonicWall devices are
installed in is "NAT Mode" - SonicWall reported to me that the ARP
requests are not sent backwards across a device in NAT mode, only
standard mode (NAT not enabled).

3) ARP traffic is very small - to create a DoS on the network, you'd
need to generate thousands of arps per second.

SonicWall firmware version 6.6 (no ETA from support) will fix these
issues.

My thought:
If you've got an attacker that close to your network, does he really
need to use your SonicWall for mapping?

Robert Auch
First initial last name at totalnetsolutions.net

0  ASCII Ribbon campaign - against HTML Email
^        - against auto-execute attachments