How to remediate – NetAsq IPS-Firewalls Detection

1. Introduction

The NetAsq IPS-Firewalls Detection vulnerability relates to NetAsq Intrusion Prevention Systems/firewalls exposing a port used for remote configuration. This allows attackers to identify systems running NetAsq, potentially focusing attacks or altering their strategy. Affected systems are typically network perimeter devices managing traffic flow. A successful exploit could lead to information disclosure and potential compromise of the firewall’s configuration, impacting confidentiality, integrity, and availability.

2. Technical Explanation

The vulnerability occurs because TCP port 1300 is open on NetAsq IPS/firewalls by default. This port allows connection from a Firewall Manager tool for remote administration. An attacker identifying this open port can confirm the presence of a NetAsq device, providing valuable reconnaissance information. There isn’t a specific CVE associated with simply having the port open; it’s more about information leakage. An example attack would involve scanning a network range and noting systems responding on TCP/1300 to target them specifically.

• Root cause: The default configuration exposes an administrative interface without restriction.
• Exploit mechanism: Attackers scan for open port 1300, identifying NetAsq devices. This allows targeted attacks or reconnaissance.
• Scope: All NetAsq IPS/firewalls with TCP/1300 open are affected.

3. Detection and Assessment

Confirming the vulnerability involves checking for the presence of an open port 1300 on potential NetAsq devices. A quick check can be done using network scanning tools, while a thorough method involves examining firewall configurations.

• Quick checks: Use `netstat -tulnp` or `ss -tulnp | grep :1300` to list listening ports and associated processes.
• Scanning: Nessus plugin ID 92865 can identify NetAsq devices with open port 1300, but results should be verified manually.
• Logs and evidence: Firewall logs may show connection attempts on TCP/1300 from unknown sources.

netstat -tulnp | grep :1300

4. Solution / Remediation Steps

The solution is to restrict access to the firewall, allowing connections only from trusted networks.

4.1 Preparation

• No services need stopping for this change. A roll back plan involves restoring the previous configuration file.
• A standard change window may be required, depending on your organisation’s policies.

4.2 Implementation

1. Step 1: Log in to the NetAsq Firewall Manager interface.
2. Step 2: Navigate to the firewall’s access control rules section.
3. Step 3: Create a new rule blocking all incoming connections on TCP port 1300 except from trusted IP addresses or networks.
4. Step 4: Save and apply the changes to the firewall configuration.

4.3 Config or Code Example

Before

# Default rule allowing all connections on port 1300 (example)
allow tcp any any port 1300

After

# Rule blocking all except trusted IPs on port 1300
block tcp any any port 1300
allow tcp 192.168.1.0/24 any port 1300 # Example trusted network

4.4 Security Practices Relevant to This Vulnerability

List only practices that directly address this vulnerability type. Use neutral wording and examples instead of fixed advice. For example: least privilege, input validation, safe defaults, secure headers, patch cadence. If a practice does not apply, do not include it.

• Practice 1: Least privilege – restrict access to administrative interfaces only from trusted sources.
• Practice 2: Network segmentation – isolate firewalls and limit external connectivity.

4.5 Automation (Optional)

# Example Ansible playbook snippet (requires NetAsq modules)
- name: Block port 1300 except from trusted network
  netasq_rule:
    name: "Block Port 1300"
    protocol: tcp
    source: any
    destination: any
    port: 1300
    action: block
- name: Allow port 1300 from trusted network
  netasq_rule:
    name: "Allow Port 1300 Trusted"
    protocol: tcp
    source: 192.168.1.0/24
    destination: any
    port: 1300
    action: allow

5. Verification / Validation

Confirm the fix by checking that connections to port 1300 are blocked from untrusted sources. Re-run the earlier detection method to verify the change.

• Post-fix check: `netstat -tulnp | grep :1300` should still show the port listening, but connection attempts from outside trusted networks should be refused.
• Re-test: Run a network scan from an untrusted host; it should not detect the open port 1300.
• Smoke test: Ensure legitimate Firewall Manager connections from trusted sources continue to function as expected.
• Monitoring: Monitor firewall logs for blocked connection attempts on TCP/1300 from unknown IP addresses.

netstat -tulnp | grep :1300

6. Preventive Measures and Monitoring

Suggest only measures that are relevant to the vulnerability type. Use “for example” to keep advice conditional, not prescriptive.

• Baselines: Update security baselines to include restrictions on administrative interface access.
• Pipelines: Implement IaC checks or configuration management rules to enforce port 1300 restrictions automatically.
• Asset and patch process: Regularly review firewall configurations for unnecessary open ports.

7. Risks, Side Effects, and Roll Back

• Roll back: Restore the previous firewall configuration file from backup.

8. References and Resources

• Vendor advisory or bulletin: http://www.netasq.com/landing/netasq-en.html