Re: Open source firewalls

[RVK <rvk@prodmail.net>]

Proxies can be a good way of filtering but it can't avoid buffer 
overflows. It can only increase it. More code more bugs. If it is 
running on a hardware firewall as a service then its more dangerous as 
once it is compramised then IDS signatures also can be deleated :-). No 
use of IDS the right ?
So the best way is either make your code free of buffer overflows or use 
some library which controls the attack during any buffer overflow or use 
Stack Randomisation and Canary based approaches.

rvk

Helge Hafting wrote:

> RVK wrote:
>
>> I don't think buffer overflow has anything to do with transparent
>> proxy. Transparent proxying is just doing some protocol filtering.
>
>
> A transparent proxy is a protocol filter, which is why it is an
> ideal way of detecting protocol-dependent buffer overflow attacks.
>
> The detection code have to be built into the proxy, of course.
>
> Examples:
> A web proxy can check for anomalous long "get" request,
> there have been web servers with buffer overflows when the
> URL was too long.  The proxy can terminate such connections,
> protecting the possibly vulnerable webserver.
>
> An ftp proxy can check for (and remove) anomalous long filenames,
> as well as funnies like "ls */*/*/*/*/*"
>
> Similiar for many other services.  The proxy approach is useful
> because knowledge of the protocol is necessary.  After all,
> it is ok to up/download a huge file via ftp, while a 2M filename
> is suspicious.  Size alone is not enough.
>
>> Still the proxy code may have some buffer overflows.
>
>
> A proxy (or any other attempt at a firewall) may have its own
> holes of course, but avoiding making them isn't that hard.
>
>
>> The best way is first to try avoiding any buffer overflows and take
>> programming precautions.
>
>
> Of course, if you have the source and that source isn't an
> unmaintainable mess.  One or both of those conditions may fail,
> and then the IDS becomes useful.
>
>> Other way is to chroot the services, if running it on a firewall.
>
>
> Provided it is an unixish server . . .
>
>> There are various mechanisms which can be used like bounding the
>> memory region it self. Stack Randomisation and Canary based approaches
>> can also avoid any buffer overflow attacks.
>
>
> These may or may not be available.  You can always stick a proxy
> firewall in front of the server though, no matter what os and
> server apps it runs.
>
> Helge Hafting
> .
>