Symantec Response
If the FTP Bounce Attack vulnerability affects your deployment, make sure that you apply the related hotfix available from the Symantec Enterprise Support site. The hotfix is an enhanced version of our FTPd module for the affected platforms that extends the protection provided by the firewall.
The module update is available for download from the Symantec Enterprise Support site (http://www.symantec.com/techsupp) for all affected versions and platforms. The following enhancements have been made:
- By default, if the firewall detects a PORT request destined for an IP address other than the IP address of the FTP client, it will log the following warning:
"353 Warning: PORT command referenced a destination (x.x.x.x) that doesn't match control channel (y.y.y.y): possible Bounce attack? To enforce strict PORT checking please set "ftpd.allow_address_mismatch=False" in the Config.cf file."
If firewall administrators decide that this is not a problem in their environment, they can disable the Warning message by setting the following Config.cf variable:
ftpd.suppress_address_mismatch_warning=True (default is False)
- If firewall administrators want to enforce strict PORT command checking and block any PORT requests that reference a different address than the original FTP client IP, they can set the following Config.cf variable:
ftpd.allow_address_mismatch=False (default is True)
By enforcing "strict" PORT checking on the firewall, security administrators do not have to make sure that all of their FTP servers are patched or configured to block the FTP Bounce Attack.
Symantec verified these security enhancements. In addition, ICSA Labs verified these enhancements for the Symantec products that are ICSA Certified Firewall Products. The new features will extend the enterprise-level protection provided by our FTP proxy which among other checks already includes protection against FTP Bounce attacks off the firewall itself, blocking PORT commands that select a well-known port, FTP strong/weak user authentication methods, GET/PUT granular security policies, FTP protocol and command verification, and transparent address hiding
Thanks for your feedback. Let us know if you have additional comments below. (requires login)