-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Users inside corporate network (LAN) are able to sniff administrator's password by means of ARP poisoning. To avoid this problem we tried to hardcode administrator's MAC address inside firewall's configuratión; But this was not the solution, as there was possible to perform the attack under this scenario too. -------------------------------------snip--------------------------------- -------------------------------------------------------------------------- --------- Symantec Firewall/VPN Appliance Internal LAN Sniffing Issue Date Reported October 2, 2002 Risk Low (on trusted side of appliance) Affected Versions: Symantec Firewall/VPN 100 (all firmware versions) Symantec Firewall/VPN 200 (all firmware versions) Symantec Firewall/VPN 200R (all firmware versions) Overview Symantec is aware of a reported ARP Poisoning issue with Symantec's Firewall/VPN product reported on the Bugtraq mailing list, ( http://online.securityfocus.com/archive/1/296539/2002-10-19/2002-10-25/0). Symantec became aware of a potential ARP Poisoning issue that only occurs on the trusted LAN ports of the affected appliances. This issue could affect Symantec Firewall/VPN Appliance deployments and could potentially allow a malicious internal user to use ARP poisoning techniques to intercept traffic that is intended for the management port. Details ARP poisoning attacks are a well-known risk of Ethernet LANs. The attacks are based on the fact that the ARP protocol, used to provide MAC (physical address) to IP address (logical address) resolution in an internal network, is not a secured protocol. There are a number of techniques for intercepting and snooping traffic on an internal LAN segment. For example, using a properly crafted spoofed ARP message, a malicious user in the internal network can carry out a man-in-the-middle attack and intercept all traffic going to a specific destination. However, protection from these types of attacks is limited and time consuming to implement, therefore, most security administrators accept the associated risk from these types of internal attacks. Symantec Recommendation Symantec has determined that the Symantec Firewall/VPN appliances operate as designed. However, the following procedures can be implemented if a secure internal remote administration is required. The Symantec Firewall/VPN Appliances can be remotely managed securely using IPSEC technology through the outside WAN ports. Symantec recommends that if ARP poisoning is of concern in your internal environment, you manage the appliance through a gateway-to-gateway VPN tunnel on the model 100/200/200R or through a client-to-gateway VPN tunnel on the model 200R. In addition, administrators can use the second WAN port of the 200/200R as an isolated local management port, thus preventing a rogue internal user from sniffing the directly connected wire. To protect against ARP attacks requires a combination of techniques and tools. For example, there are tools available in the field that will alert administrators when an ARP request has caused a change in MAC-IP address entry. These are useful for detecting anomalies, however, they often require making trade offs in network management - for example, DHCP must be disabled. Additional protection is sometimes provided natively by operating systems. Certain Microsoft operating system's will detect a duplicate IP address on a LAN (an indication of a possible ARP spoof attack). Others allow you to lock down ARP entries in your ARP table so that once the table is populated; a rogue system is not able to reset the ARP entry to another MAC or IP address. Another alternative is to encrypt all traffic using secured protocols such SSL, SSH, or IPSEC to provide data confidentiality and data integrity for sensitive communication. Credit Symantec takes the security and proper functionality of our products very seriously. Anyone with information on security issues with Symantec products should contact symsecurity@symantec.com. The Sym Security PGP key can be downloaded from http://securityresponse.symantec.com/avcenter/security/publickey/SymSecuri ty.asc. Copyright (c) 2002 by Symantec Corp. Permission to redistribute this Alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this Alert in medium other than electronically requires permission from symsecurity@symantec.com. Disclaimer: The information in the advisory is believed to be accurate at the time of printing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect or consequential loss or damage arising from use of, or reliance on this information. Symantec, Symantec products, Symantec Security Response, and SymSecurity are Registered Trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.