Allele Security Alert
ASA-2019-00271
Identifier(s)
ASA-2019-00271, CVE-2019-5598, FreeBSD-SA-19:06.pf
Title
ICMP/ICMP6 packet filter bypass in pf
Vendor(s)
The FreeBSD Project
Product(s)
FreeBSD
Affected version(s)
All supported versions of FreeBSD
Fixed version(s)
2019-03-21 14:17:10 UTC (stable/12, 12.0-STABLE)
2019-05-14 23:12:22 UTC (releng/12.0, 12.0-RELEASE-p4)
2019-03-21 14:17:12 UTC (stable/11, 11.3-PRERELEASE)
2019-05-14 23:12:22 UTC (releng/11.2, 11.2-RELEASE-p10)
Proof of concept
Unknown
Description
pf(4) is an Internet Protocol packet filter originally written for OpenBSD. In addition to filtering packets, it also has packet normalization capabilities.
States in pf(4) let ICMP and ICMP6 packets pass if they have a packet in their payload matching an existing condition. pf(4) does not check if the outer ICMP or ICMP6 packet has the same destination IP as the source IP of the inner protocol packet.
A maliciously crafted ICMP/ICMP6 packet could bypass the packet filter rules and be passed to a host that would otherwise be unavailable.
Technical details
Unknown
Credits
Synacktiv
Reference(s)
ICMP/ICMP6 packet filter bypass in pf
https://www.freebsd.org/security/advisories/FreeBSD-SA-19:06.pf.asc
CVE-2019-5598
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5598
CVE-2019-5598
https://nvd.nist.gov/vuln/detail/CVE-2019-5598
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: May 15, 2019