CVE-2005-2317
Shorewall 2.4.x before 2.4.1, 2.2.x before 2.2.5, and 2.0.x before 2.0.17, when MACLIST_TTL is greater than 0 or MACLIST_DISPOSITION is set to ACCEPT, allows remote attackers with an accepted MAC address to bypass other firewall rules or policies.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.31%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Shorewall 2.4.x before 2.4.1, 2.2.x before 2.2.5, and 2.0.x before 2.0.17, when MACLIST_TTL is greater than 0 or MACLIST_DISPOSITION is set to ACCEPT, allows remote attackers with an accepted MAC address to bypass other firewall rules or policies.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 2.31% probability · 82th percentile
- CISA KEV
- Not listed
- Affected
- shorewall/shorewall
- Source
- cve@mitre.org
References
- http://seclists.org/lists/fulldisclosure/2005/Jul/0409.htmlPatch, Vendor Advisory
- http://secunia.com/advisories/16087Patch, Vendor Advisory
- http://secunia.com/advisories/17110
- http://secunia.com/advisories/17113
- http://shorewall.net/News.htm#20050717Patch, Vendor Advisory
- http://www.debian.org/security/2005/dsa-849
- http://www.gentoo.org/security/en/glsa/glsa-200507-20.xml
- http://www.securityfocus.com/bid/14292
- http://www.ubuntu.com/usn/usn-197-1
- http://seclists.org/lists/fulldisclosure/2005/Jul/0409.htmlPatch, Vendor Advisory
- http://secunia.com/advisories/16087Patch, Vendor Advisory
- http://secunia.com/advisories/17110
- http://secunia.com/advisories/17113
- http://shorewall.net/News.htm#20050717Patch, Vendor Advisory
- http://www.debian.org/security/2005/dsa-849
- http://www.gentoo.org/security/en/glsa/glsa-200507-20.xml
- http://www.securityfocus.com/bid/14292
- http://www.ubuntu.com/usn/usn-197-1
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.