COMMAND
	Norton Personal Firewall 2002 is vulnerable to SYN/FIN scan
SYSTEMS AFFECTED
	Norton Personal Firewall 2002
PROBLEM
	Alfonso  Fiore  [http://www.secure-edge.com/]  found  following  bug  on
	Norton Personal Firewall 2002 :
	Norton Personal Firewall 2002 on Windows 2000 is vulnerable  to  SYN/FIN
	scan (SYN/FIN/URG, SYN/FIN/PUSH, SYN/FIN/URG/PUSH are  not  detected  as
	well) also if you activate "detect portscan".
	The windows machine answers the same way with or without NPF.  open  TCP
	port answer (hping output):
	
	len=46 ip=a.b.c.d sport=135 flags=SA DF seq=5 ttl=128 id=112 win=16616 rtt=0.8 ms
	
	close TCP port answer (hping output):
	
	len=46 ip=a.b.c.d sport=136 flags=RA seq=6 ttl=128 id=113 win=0 rtt=0.6 ms 
	
	This way, you can check which ports are  listening  and  you  don't  get
	blacklisted. When NPF detects a port scan, it filters all  packets  from
	the source IP for the next 30 mins. By the way, I  tried  to  understand
	this feature: after some tests, I got the idea that NPF stops  ONLY  SYN
	packets FROM the blacklisted IP. This means that you can  STILL  perform
	a SYN/FIN scan while blacklisted and also that you can  go  on  with  an
	established connection from a blacklisted IP. You  just  can't  start  a
	new connection FROM the blacklisted machine (but you can start  it  from
	the "protected" PC). I guess  this  way  to  implement  a  blacklist  is
	mainly for performances. Any comment?
	Moreover, since you can't change the 30  mins  default  blacklist  time,
	this can help a lot in fingerprinting Norton  Personal  Firewall  making
	your IP blacklisted and then trying to send  again  SYN  packets  on  an
	open port after 30 mins.
	In my probe test, I also tried to check the claim "block  fragmented  IP
	Packets" in advanced options, attacking the windows  box  with  the  old
	jolt2 (MS00-029 May 2000). Of course, the windows 2000 has NO  patch  or
	SP which would prevent the attack to success. You might say  a  computer
	should always be uptodate with patches, but this was a  proof-of-concept
	of a future undiscovered fragmented IP bug  againts  a  claim  of  being
	able to block fragments.
	NPF is NOT able to protect my Windows 2000 against jolt2.
SOLUTION
	Nothing yet.