On Mon, 10 Apr 2006, 3APA3A wrote:
--Wednesday, April 5, 2006, 2:12:10 PM, you wrote to bugtraq@xxxxxxxxxxxxxxxxx: CK> is open for any attacks as long as they are IPv6 based. If that CK> is right, this is an extremly nasty bug. If ISA Server 2004 and CK> Windows 2003 Basic Firewall cannot filter that stuff it should CK> simply drop it. You are not right. 1. IPv6 is not installed by default. 2. If IPv6 is installed, routing is not enabled by default. 3. If you install IPv6, you can be bind it to only interfaces it's required. To prevent IPv6 (or another routable protocol, such as IPX) on external interface you can (and you should) unbind this protocol from interface in network connection properties. ISA is not required for this task and is not supposed for this task.
Thanks for clearing that. But: If ISA is not able to filter IPv6 so why can it be bound to an interface anyway? Just to route things through? Blindly through a firewall? Another posting talks about limited filtering capabilities. Roman wrote, icmp went through. So where is the borderline? It still seems to me that in the moment for what ever reason ipv6 is enabled on ISA the network it should secure is exposed. Cheers, Christine Kronberg. -- Shalla Secure Services
