Stormshield Network Security

CVSS v3.1 Overall Score: 0      

Analysis

Impacted version

Context:

Rogue DHCP Attack is type of attack aims to perform address spoofing, where the attacker exploits a standard routing behavior that prioritizes routing to the smallest network.

SNS Behavior:

Through its IPS mechanism and address spoofing detection, SNS offers an adequate countermeasure to detect and block this type of attack. These mechanisms are enabled by default and are detailed here: Stormshield Documentation.

Attack Execution:

As indicated in the SSTIC 2024 presentation, On SNS it is imperative to disable the IPS and anti-spoofing protections of SNS, which are enabled by default, to carry out this attack.

However, in the default configuration, SNS, with its anti-spoofing protections, will detect the use of an IP that does not belong to this interface and will block the packet by raising an IP spoofing alarm (Type 2), resulting in the disconnection of the connection and preventing the attacker from reaching the server.

Conclusion:

SNS is not vulnerable in standard usage scenarios.

No version is impacted

Workaround solution

Solution

N/A

Use the recommended configuration available here Stormshield Documentation.