VPN Appliance

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

low complexity

symantec

nessus

NVD

Published: 2004-12-31

Updated: 2017-07-11

Summary

Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R running firmware before 1.63 and Gateway Security 320, 360, and 360R running firmware before 622 allow remote attackers to bypass filtering and determine whether the device is running services such as tftpd, snmpd, or isakmp via a UDP port scan with a source port of UDP 53.

Vulnerable Configurations

Part	Description	Count
Hardware	Symantec Symantec Firewall VPN Appliance 100 * Symantec Firewall VPN Appliance 200 * Symantec Firewall VPN Appliance 200R * Symantec Gateway Security 320 * Symantec Gateway Security 360 * Symantec Gateway Security 360R * Symantec Nexland ISB Soho Firewall Appliance * Symantec Nexland Pro100 Firewall Appliance * Symantec Nexland Pro400 Firewall Appliance * Symantec Nexland Pro800 Firewall Appliance * Symantec Nexland Pro800Turbo Firewall Appliance * Symantec Nexland Wavebase Firewall Appliance *	12

Nessus

NASL family	Firewalls
NASL id	KERIO_PF_UDPBYPASS.NASL
description	It is possible to bypass the rules of the remote firewall by sending UDP packets with a source port equal to 53. An attacker may use this flaw to inject UDP packets to the remote hosts, in spite of the presence of a firewall.
last seen	2020-06-01
modified	2020-06-02
plugin id	11580
published	2003-05-06
reporter	This script is Copyright (C) 2003-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/11580
title	Firewall UDP Packet Source Port 53 Ruleset Bypass

Summary

Vulnerable Configurations

Nessus

References