Security Advisory Detail

Inferring and hijacking VPN-tunneled TCP connections

Advisory ID
WGSA-2019-00002
CVE
CVE-2019-14899
Impact
High
Status
Not Applicable
Product Family
Firebox, WatchGuard Cloud
Published Date
Updated Date
Workaround Available
True
CVSS Score
7.4
CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Summary

On December 8th, 2019, security researcher William Tolley published vulnerabilities found in multiple Linux and Unix operating systems, allowing the attacker some access to the VPN. An attacker using this technique could compromise SSL VPN, IPsec, and WireGuard (a VPN application) connections. The attacker must be local to the vulnerable system and view all incoming and outgoing traffic to the system. The attacker uses packet-size analyses to determine the VPN packets and attempts to take over a connection by spoofing SYN/ACK packets. When successful, an attacker could compromise the VPN and potentially interfere with protected traffic.

The Firebox uses an SSL VPN client for Management Tunnels and BOVPN-Over-TLS. It is not affected by this vulnerability.

For this attack to work, a specially crafted packet is sent to the victim. When the crafted packet contains the correct IP, the vulnerable system will respond with a reset. The Firebox does not respond to this packet no matter if the virtual IP address is correct or not.

While the vulnerability does not affect WatchGuard devices, it could still compromise VPN connections to a Firebox if the client OS is vulnerable.

Advisory Product List
Product Family
Product Branch
Product List
Firebox
XTM 8 Series (2nd Gen)
XTM850, XTM860, XTM870, XTM870-F
Firebox
XTM 1500 and 2520
XTM1520-RP, XTM1525-RP, XTM2520
Firebox
Firebox T (1st Gen)
T10, T10-W, T10-D, T30, T30-W, T50, T50-W
Firebox
Firebox T (2nd Gen)
T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70
Firebox
Firebox T (3rd Gen)
T20, T20-W, T40, T40-W, T80
Firebox
Firebox M (1st Gen)
M200, M300, M400, M440, M500
Firebox
Firebox M (2nd Gen)
M270, M370, M470, M570, M670
Firebox
Firebox M (3rd Gen)
M290, M390, M590, M690, M4800, M5800
Firebox
FireboxV
Small, Medium, Large, XLarge
Firebox
XTMv
Small, Medium, Large, Datacenter
Firebox
FireboxCloud
Small, Medium, Large, XLarge
WatchGuard Cloud
WatchGuard Cloud
WatchGuard Cloud