Re: Defend against FTP bounce attack
By: Digital Man to Karloch on Mon Feb 15 2021 14:23:25
Hi DigitalMan,
Thanks for the head's up. The Synchronet FTP server has (since 2001) rejected FTP-Bounces to reserved/system TCP ports (< 1024), so I'm not sure how "vulnerable" it really was, but in any case, I've committed a change to
Indeed, I put the wrong example in my previous message, my tests were using ports >1024. I don't think it was anything to worry about, as a possible attacker can only use it to do a port scan, but not actually access anything. Qualys security scanner qualify this as "potential" in color "yellow". Usually actual serious vulnerabilities are marked "red".
disallow FTP Bounces to *any* TCP port on a 3rd party IP address, by default. --
Just upgraded the Synchronet version to the latest commit and did both, Qualys security scanner and manual test myself and indeed, Synchronet FTP server is not allowing them anymore. I also tried to connect to the FTP using active mode and it works as expected, so I didn't experienced any impact after the patch.
Superb work! Thank you for taking care of it so swiftly.
Regards,
Carlos
---
� Synchronet � HISPAMSX BBS - The 8-bit MSX computers BBS - 2:341/111@fidonet
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)