[cobalt-users] RaQ4: How to prevent by-passing firewall rules by sending UDP:53

["Al-Juhani" <aljuhani@xxxxxxxxx>]

Hello List.

I have a RaQ4 with IPchains installed but not tightly configured as I only
have certain ports blocked plus some ISPs that have been source of scans ..

Today I performed a Security Audit from a third-party comapny and in thier
report they have indicated the following vulnerability.

----
Vulnerability found on port general/udp:

It is possible to by-pass the rules of the remote firewall
by sending UDP packets with a source port equal to 53.

An attacker may use this flaw to inject UDP packets to the remote
hosts, in spite of the presence of a firewall.

Solution : Review your firewall rules policy
Risk Factor : High
----

I am not sure as I tried before to apply some control on DNS running on the
Server but caused many problems ..

Any idea,

Thanks

Al-Juhani
aljuhani@xxxxxxxxx