[Top] [All Lists]

OSDL Bugzilla #2399: A user can remotely route a packet through eth0 on

To: netdev@xxxxxxxxxxx
Subject: OSDL Bugzilla #2399: A user can remotely route a packet through eth0 on a Linux machine
From: Nivedita Singhvi <niv@xxxxxxxxxx>
Date: Tue, 11 May 2004 11:07:00 -0700
Cc: snortwiz@xxxxxxxxxxx
Sender: netdev-bounce@xxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1) Gecko/20030225
Forwarding a bug report from Jared McLaren below.
Any thoughts?


I couldn't Google up any information on this situation, so here goes...


Hardware Environment:
Gateway 450SX4 laptop

Software Environment:
Mandrake 10, kernel 2.6.3-4mdk

Problem Description:
While pen-testing a dual-homed Linux-based VPN appliance, I discovered the
device would route packets between its two interfaces without ip forwarding
enabled.  I could route packets directly to the external interface by setting
the internal interface as the gateway.  This device is based on a 2.4 kernel.  I
tested this on my Mandrake 10 (2.6.3-4mdk) laptop and found the same results
from the 2.6.x kernel.

For a test, I placed my wireless network card (eth1) in my laptop and assigned
it the IP address  I bound SSH to and restarted
SSH.  My wired ethernet card (eth0) was at IP address  On a
remote desktop, I confirmed SSH was not available on  On that
remote desktop I then added a route to using gateway
and could then SSH to  A 'cat' or /proc/sys/net/ipv4/ip_forward
on the Linux laptop was "0" so ip forwarding was not enabled.

The end result is that you can reach services bound to an interface on a Linux
machine that you may not be able to normally reach.  This was all performed in
the default kernel configuration.  This is only possible when one of the
interfaces resides on your network segment since it is used as a gateway.

Steps to reproduce:
        a) Use a dual-homed machine (eth0, eth1)
        b) bind a service to eth1
        c) from a different machine, add a route to the IP of eth0
        d) attach to the service on the IP of eth1

<Prev in Thread] Current Thread [Next in Thread>