Checkpoint FW-1 and "ftp missing newline char" attack

Sep 29, 2004 4 Replies

Howdy.



I'm trying to log in to a customer's ftp server from an AIX 5.3 box behind FW-1. This is eventually going to be a cron job, but right now I'm trying it manually for testing purposes.



I *have* to use passive mode.



Logging in defaults to active. No problem cding, lsing, getting, etc. Then I issue the passive command, after which any attempt to use the data port completely hangs the session.



Checking SmartView Tracker says that the firewall rejected the data request due to an 'ftp missing newline char' attack, and subsequent packets get dropped because they're out of state.



The admin at the customer site swears up and down that he's got passive mode enabled and the high ports open to me on his end. I've tried logging in to both his AS/400 and his MS box with the same results.



Anybody have any ideas?



Thanks.



I should probably add that ncftp, which apparently defaults to passive mode for data transfer, hangs in the same way as the normal client.


Liam Dolan is alleged to have said in comp.security.firewalls:

Run cpstop.

Look for this section:

// Use this if you do not want the FW-1 module to insist on a newline at the // end of the PORT command: // #define FTPPORT(match) (call KFUNC_FTPPORT )

#define FTP_ENFORCE_NL

Change it to this:

// Use this if you do not want the FW-1 module to insist on a newline at the // end of the PORT command: #define FTPPORT(match) (call KFUNC_FTPPORT )

//#define FTP_ENFORCE_NL

Run cpstart.

Install the policy.

Enjoy.

Keep in mind this fix gets wiped out when you upgrade the firewall.

so what is the script that we are suppose to use? I'm not seeing it

: so what is the script that we are suppose to use? I'm not seeing it.

What version is this? I believe this check was somewhat buggy, atleast it seemed that you wouldn't get a very reliable ftp service with this option enabled.

The background for this option can be found in this bugtraq posting:

formatting link
Lars

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required