On Sat, 13 Dec 2003 03:35:25 MST, Michael Gale <michael@bluesuperman.com> said: > For example the BorderWare Firewall will not accept fragmented packets, > they are working on a firewall function that when fragmented packets > arrive. It will save the first piece plus all frags until the final one > is received. But the packet back together and do a sanity check of some > sort. Then pass or drop the packet. So the problem is that the host may re-assemble a fragmented packet with injected data in it. And we protect against it by.... you got it.. having the firewall re-assemble the fragmented packet with injected data and then handing the re-assembled full packet (with injected data) to the host. Whoops.
Attachment:
pgp00032.pgp
Description: PGP signature