1677940 - (CVE-2021-23961) Consider blocking ports 69, 137, 161, 1719, 6566, 10080

Status: RESOLVED FIXED

(Core :: Networking, task)

Description

[Frederik Braun [:freddy]]

+++ This bug was initially created as a clone of Bug #1677047 +++

Samy thinks that we should also block the ports for the following protocols:

• 6566 SANE
• 10080 Amanda
• 69 TFTP
• 161 SNMP
• 1719 H323 (RAS)
• 137 NetBIOS

Comment 1

[Frederik Braun [:freddy]]

The more ports we add, the more concerned I am about breakage, but I'll write a patch..

Comment 2

[Frederik Braun [:freddy]]

Attachment: Bug 1677940 Consider blocking ports 69, 137, 161, 1719, 6566, 10080 r?valentin

Comment 3

[Frederik Braun [:freddy]]

Attachment: Bug 1677940 - clang-format r?valentin

Depends on D97423

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/integration/autoland/rev/0ec077c24f11de2e7965b3589019c4bcae6db92f
https://hg.mozilla.org/integration/autoland/rev/8ecf6fa65cd8f890d8c80c6bc519e63ececadcb0
https://hg.mozilla.org/mozilla-central/rev/0ec077c24f11
https://hg.mozilla.org/mozilla-central/rev/8ecf6fa65cd8

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Hi freddy, does this need approval requests also?

Comment 6

[Frederik Braun [:freddy]]

Of all changes, this seems to be the most controversial. Other folks expect push back especially for port 10080 (looking at code search and given that it's ending on "80". I would rather have this one ride the trains.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

OK. I'll set ESR78 back to ? for now and we can decide at a later time if it's needed there or not after more bake time.

Comment 8

[Samy Kamkar]

Regarding the 10080 port, that ALG requires the communication to use UDP so I think it would be reasonable to allow 10080 TCP but block 10080 UDP (eg when using UDP STUN/TURN)
https://github.com/torvalds/linux/blob/3c00fb0bf0e0f061715c04ad609de93ddc046aa1/net/netfilter/nf_conntrack_amanda.c#L178-L199

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Hi Freddy, we're a week out from the 78.7esr RC. Have we given any more thought as to whether we want to include this change or not?

Comment 10

[Frederik Braun [:freddy]]

Attachment: advisory.txt

Comment 11

[Frederik Braun [:freddy]]

Comment on attachment 9188543 [details]
Bug 1677940 Consider blocking ports 69, 137, 161, 1719, 6566, 10080 r?valentin

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: likely to be more dangerous in enterprise settings, as their local network is busier and has more interesting services
• User impact if declined: missing a security fix
• Fix Landed on Version: 85
• Risk to taking this patch: Medium
• Why is the change risky/not risky? (and alternatives if risky): blocking access to specific ports is tricky. we have no insights as to whether it will break things for a specific enterprise. that being said, a pref exists to allow specific ports regardless of our defaults
• String or UUID changes made by this patch: none

Comment 12

[Frederik Braun [:freddy]]

A bit more information for the approval request: Chrome finally decided to implement port 10080 blocking as well as per https://github.com/whatwg/fetch/issues/1191#issuecomment-815434180
I didn't want us to backport until we know we won't undo it, but chrome's support convinced me we're unlikely to revert now

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9188544 [details]
Bug 1677940 - clang-format r?valentin

AFAICT this isn't needed for the uplift. Try seems fine without it.

Comment 14

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9188543 [details]
Bug 1677940 Consider blocking ports 69, 137, 161, 1719, 6566, 10080 r?valentin

Approved for 88.0b9.

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr78/rev/f4902ab73db4

Comment 16

[Andrew Siplas]

(In reply to Frederik Braun [:freddy] from comment #1)

The more ports we add, the more concerned I am about breakage, but I'll write a patch..

This breaks captive portal (“Guest WiFi”) on Linksys WRT1900AC… any chance of a “Continue Anyways” button?

See https://www.reddit.com/r/HomeNetworking/comments/nyr6il/tcp_port_10080_blocked_by_google_chrome/ and https://stackoverflow.com/questions/27209915/bash-curl-wget-with-linksys-guest-network

Comment 17

[Frederik Braun [:freddy]]

There has been a bit of an explanation of why we can't easily revert our logic in https://bugzilla.mozilla.org/show_bug.cgi?id=1689107#c10, but I could imagine a "temporarily allow for this site" functionality... Let's file a feature request.