Of course these access list may not actually be applied to any interface
plus the access list is useless with out corresponding nat statements, so
don't burn the entire network quite yet.
_____
From: Chris Serafin [mailto:chris@chrisserafin.com]
Sent: 02 January 2006 20:53
To: 'Compuoso'; firewalls@securityfocus.com
Subject: RE: Strange entries in Cisco PIX 515e
_____
From: Compuoso [mailto:compuoso@gmail.com]
Sent: Sunday, January 01, 2006 4:38 AM
To: firewalls@securityfocus.com
Subject: Strange entries in Cisco PIX 515e
Would someone please tell me the overall meaning and implications of the
following PIX command lines? I discovered them in our PIX 515e configuration
earlier this morning. I suspect that our corporate network has been hacked.
Thanks for your collective insight.
Naming the interface 'intf2' with a security level of '4'
nameif ethernet2 intf2 security4
permiting internal host 172.. to access anything = domain
access-list test permit udp host 172.17.7.10 any eq domain
permiting anyone to access internal = domain
access-list test permit udp any eq domain host 172.17.7.10
permiting external host 63.... to access anything = domain
access-list test1 permit udp host 63.176.109.161 any eq domain
permiting anything to access 63.. = domain
access-list test1 permit udp any eq domain host 63.176.109.161
permit anyone to access anyone = domain
access-list test1 permit udp any any eq domain
same
access-list test1 permit udp any eq domain any
MTU size = means nothing
mtu intf2 1500
no ip address configured
no ip address intf2
Well whoever wrote the config's is an amateur, cause why configure 1
inetrnal , 1 external, and then configure EVERYONE for access.?
Act as if it was hacked, audit ALL config files , check flash: dir for weird
files , change passwords and log everything, assume all SNMP and syslog
server have been compromised
Or it could be nothing........just the last shitty admin's work
Chris Serafin
IT Security / Voice Engineer
chris@chrisserafin.com
smime.p7s
Description: S/MIME cryptographic signature
