Bug 1297090

Summary:	iptables -L starts the firewall with a blank configuration after the firewall is stopped
Product:	Red Hat Enterprise Linux 6	Reporter:	Simon Mijolovic <smijolovic>
Component:	iptables	Assignee:	Thomas Woerner <twoerner>
Status:	CLOSED NOTABUG	QA Contact:	qe-baseos-daemons
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	6.7	CC:	eh, iptables-maint-list, smijolovic
Target Milestone:	rc	Flags:	twoerner: needinfo? (smijolovic)
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-08 11:35:58 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Simon Mijolovic 2016-01-09 01:10:50 UTC

Description of problem:

The ip(6)tables service has a severe issue that impacts the ability to use configuration management automation solutions and is a security vulnerability opening up the firewall for host attack.  When the firewall is in the stopped state, the execution of ip(6)tables -L restarts the firewall with a blank configuration.


Version-Release number of selected component (if applicable):

iptables-1.4.7-16.el6.x86_64
iptables-ipv6-1.4.7-16.el6.x86_64

How reproducible:

Always

Steps to Reproduce:

1. service ip(6)tables stop
2. service ip(6)tables status
(shows ip(6)tables: Firewall is not running)
3. iptables -L
4. service ip(6)tables status

Actual results:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 


Expected results:

Should show "ip(6)tables: Firewall is not running", and should not be in the running state.

Additional info:

Comment 1 Simon Mijolovic 2016-01-09 01:23:00 UTC

This should be a possible candidate for a CVE.

Comment 3 Thomas Woerner 2016-07-28 14:13:52 UTC

Why is this a "a security vulnerability"? Not having rules is the same as default policy ACCEPT.

Comment 4 Thomas Woerner 2016-07-28 14:16:12 UTC

If you do not want to load the base netfilter modules, then you could use the iptables-save command.

Comment 5 Thomas Woerner 2016-11-08 11:35:58 UTC

The iptables -L command is loading netfilter modules if they are not loaded, yet.

The iptables init script is offering a way to list the rules only if the base netfilter modules are loaded: "service iptables status"
Also iptables-save can be used.

Closing this bug as not a bug.