1. Home
  2. Networking Firewalls
  3. Big Hole on 3Com FastIP -- The Broken Vlan

Big Hole on 3Com FastIP -- The Broken Vlan

Hi, I found there is a big security problem on 3Com Switchs those support FastIP.

Steps:

1, Configure the switch enable FastIP(only appear on web configure); 2, Create 2 VLANs based port, such as vlan 100 and vlan 200; 3, Add ports 2 vlan 100 and vlan 200; 4, Prepare 2 PCs, connect to the ports belongs to the diffrent Vlan; 5, Configure 2 PC's IP , make them in the same ip segment; 6, Lookup 2 PCs MAC address, then rigster them as static ARP recoders use "arp -s ..."; 7, Now, These 2 pc can ping each other---pass through the diffrent Vlans!

I made a capture use ethereal, there are no NHRP packet has been captured . And, some vendors equipments(such as Huawei) does not need to input the static arp .

Conditions:

1,Switchs: 3Com 3300SM Operational Version : 2.71 Hardware Version : 0 Boot Version : 1.00 MAC Address : 00:04:0b:80:2a:78 Product Number : 3C16987A Serial Number : 7MCV5802A78 2,PCs: 3 types OS tesed: Windows XP ,Linux and TP-LINK Wileless Router NIC: 3 types NIC tesed: RTL8139, 3Com905c (embedded on mainboard), Intel pro/100+

zt

Reply to
Iron.Surf
Loading thread data ...

Did you try reporting the issue to 3Com?

[snip]

There is no other device connected to the switch? No router, no third PC, no uplink to other switches/networks?

I've always said not to trust VLANs for security, but unless your switch does "layer 3 switching" this is just ridiculus.

- Eirik

Reply to
Eirik Seim

Eirik Seim =E5=86=99=E9=81=93=EF=BC=9A

yes. they will re-act it then reply to me.

No any other device . they communacate directly---they know other's arp. and i can see the packets between them.

this problem does not exist if 'fastip' was disabled.;)

any one can do the test on other switches which supports 'fastip'?

Reply to
Iron.Surf

This is a pretty unacceptable hole, but, it does require you to specifically add in static arp entries to enable it. Most firewalls can be configured into bad security if you work at it, some way or another. So I wouldn't think that owners of these devices should start to panic about it.

The danger of this hole is that somebody separately figures out how to poison the arp cache from outside, allowing them to enact this remotely

-Russ.

Reply to
Somebody.

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.