Multiple BSD ipfw / ip6fw ECE Bit Filtering Evasion vulnerability?

DarrenCox

Hi,

First post, so please forgive and correct me if I'm in the wrong place etc.

We have had a risk assessment performed by a security company who said that the pfsense firewalls we use are vulnerable for "Multiple BSD ipfw / ip6fw ECE Bit Filtering Evasion". The text of the assessment also says "The remote host seems vulnerable to a bug wherein a remote attacker can circumvent the firewall by setting the ECE bit within the TCP flags field. At least one firewall (ipfw) is known to exhibit this sort of behaviour. Known vulnerable systems include all FreeBSD 3.x ,4.x, 3.5-STABLE, and 4.2-STABLE."

Isn't pfsense using a much later version than 4.2-STABLE? Can this possible vulnerability be ignored?

Version we use is 2.4.4-RELEASE-p3 (FreeBSD 11.2-RELEASE-p10) as a virtual machine.

NollipfSense

@darrencox Before anyone can discuss security risk with you, you must upgrade to the current version of pfSense, hands down.

DarrenCox

OK, I'll update and ask for the scan to be run again, I reckon it will come back with the same issue though...

stephenw10

Also note that pfSense includes ipfw (in 2.6) but does not use it for anything but the captive portal, imiters and HAProxy forwarding. pfSense uses pf for actually filtering most traffic.

Steve

DarrenCox

@NollipfSense, I note that I need to upgrade, but considering @stephenw10's comment about the ipfw service, would it be possible to disable the ipfw service, as I do not use those features, and then the scan would not come up with the issue?

stephenw10

It's not a service that can be disabled like that. The scan is almost certainly just seeing the FreeBSD version and pulling in any known vulns from that. I assume you had to allow them some access to the firewall?

DarrenCox

Hi @stephenw10 , yes, they had external access only and were scanning the IPs. As you say its likely their scanner came back with "FreeBSD firewall" but no specifics. If I can get more details of what the scan actually found I'll post it, but I'll continue to work on the upgrade and ask for a re-scan when complete.