Description
Shorewall 2.4.x before 2.4.1, 2.2.x before 2.2.5, and 2.0.x before 2.0.17, when MACLIST_TTL is greater than 0 or MACLIST_DISPOSITION is set to ACCEPT, allows remote attackers with an accepted MAC address to bypass other firewall rules or policies.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | shorewall | 2.4.1-2 | — |
| Debian 13 | shorewall | 2.4.1-2 | — |
| Debian 12 | shorewall | 2.4.1-2 | — |
| Debian 3.1 | shorewall | 2.2.3-2 | DSA-849-1 |
Advisories 1
- DSA-849-1 shorewall - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- 14292 vdb-entry
- DSA-849 vendor-advisory
- http://shorewall.net/News.htm#20050717
- 17110 third-party-advisory
- USN-197-1 vendor-advisory
- 17113 third-party-advisory
- 16087 third-party-advisory
- GLSA-200507-20 vendor-advisory
- 20050718 Shorewall MACLIST Problem mailing-list