Does such attack exist? Forgive my wild imagination but is it possible for a hacker to pretend/try to communicate with a service on the server and when the firewall examines the traffic it get's poisoned or taken control of? If such scenario exists what is the name of such attack?

To my understanding firewalls are unlike proxies, they don't receive the traffic and regenerate it but they only examine it which makes things more difficult

3 Answers 3


Yes, definitely. See the Witty worm for an example of a vulnerability in a firewall product that was exploited by a network worm.

Firewalls are nothing but software and affected by the same flaw. The more complex the firewall, the more likely it is for a bug to be introduced.

For instance, a simple port filtering firewall is very unlikely to be affected by the data content of the packets but it can be affected by anything that is in the IP or protocol headers (TCP/UDP/ICMP/etc.) while a deep packet inspection firewall might include a vulnerable parser that could be exploited.


Other possibilities are (or could be):

  • exhausting resources on the firewall, leading to a denial of service - e.g. due to a need to keep connection state
  • DNS cache poisoning if the firewall tries to resolve IP addresses
  • XSS on a page denying HTTP connection
  • breaking or poisoning firewall logs (ANSI bomb) or exploiting a software reading the logs

The meaning of the word Firewall is not clearly defined. Firewalls can be anything from simple packet filters up to complex application level inspections. The more complex a firewall is, the greater is its attack surface and the more it has to protect itself.

Some examples of possible attacks against a firewall:

  • If the firewall does virus scanning you can attack the virus scanner. The scanners have to work with a variety of input formats and like the applications they try to protect they are prune to errors. So a firewall has to put the virus scanner itself into some kind of protected zone (chroot, jail, container, VM...) to make sure that exploits against the scanner does not affect the integrity of the firewall.
  • Web based attacks against administrator: Firewalls create log files and the administrator looks into these logs. Often this is done through a web interface while being logged in as administrator. If the firewalls fails to properly escape all logs it might be possible for an attacker to cause a CSRF or XSS attack by manipulating a log entry (like accessing a specific URL through the firewall which then gets logged). This attack then might reconfigure the firewall and do things like add another administrative user for the attacker.

These attacks are not only theoretical. There are reports of exploitable vulnerabilities in virus scanners and of CSRF and XSS in administrative interfaces of firewalls.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .