SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Networking Stack (TCP/IP)  >   TCP/IP Stack Implementation Vendors:   [Multiple Authors/Vendors]
Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
SecurityTracker Alert ID:  1009886
SecurityTracker URL:  http://securitytracker.com/id/1009886
CVE Reference:   CVE-2004-0230   (Links to External Site)
Updated:  Oct 10 2006
Original Entry Date:  Apr 20 2004
Impact:   Denial of service via network
Exploit Included:  Yes  

Description:   A vulnerability was reported in several TCP stack implementations. A remote user may be able to cause denial of service conditions using a TCP reset attack. Multiple vendors are affected.

The UK National Infrastructure Security Co-Ordination Centre (NISCC) reported that some implementations of the Transmission Control Protocol (TCP) are particularly vulnerable to TCP reset attacks. A remote user can cause TCP sessions to terminate prematurely, causing denial of service conditions.

The specific impact on applications that use TCP depends on the mechanisms built into the application to address premature TCP session termination.

According to the report, NISCC considers the Border Gateway Protocol (BGP) to be one of the most affected applications, as it relies on a persistent TCP session between BGP peer entities. Premature termination of an underlying TCP session may require routing tables to be rebuilt and may cause "route flapping". In the case of BGP, using the TCP MD5 Signature Option and anti-spoofing measures can mitigate the vulnerability.

Other applications, such as Domain Name System (DNS) and (Secure Sockets Layer) SSL based applications may also be affected, but to a lesser degree, the report said.

A remote user can reportedly send a TCP packet with the RST (reset) flag set (or the SYN flag) with the appropriate spoofed source and destination IP addresses and TCP ports to cause the TCP session to be terminated. Ordinarily, the remote user may have the probability of 1 in 2^32 of guessing the correct sequence number, the report said. However, in actuality, a remote user may be able to guess an appropriate sequence number with much greater probability because many implementations will accept any sequence number within a certain window of the expected sequence number. The Associate Press reports that the proper number can be guessed within as few as four attempts, requiring only seconds to achieve.

The report credits Paul A. Watson for discovering a practical method for conducting TCP reset attacks (presented in "Slipping In The Window: TCP Reset Attacks" at the CanSecWest 2004 conference).

The report indicates that the following vendors are affected [this is not an inclusive list]:

- Cray Inc. is vulnerable on their UNICOS, UNICOS/mk and UNICOS/mp systems

- Check Point is affected, but has issued a protection mechanism in the latest release for VPN-1/FireWall-1 (R55 HFA-03) that can protect both the firewall device and hosts located behind the firewall.

- Internet Initiative Japan, Inc (IIJ) is affected.

- InterNiche NicheStack and NicheLite are affected.

- Juniper Networks products are affected.

- Cisco products are affected, including IOS and non-IOS based devices.

Other vendors are assessing the impact of this flaw.

The NISCC Vulnerability Advisory 236929 is available at:

http://www.uniras.gov.uk/vuls/2004/236929/index.htm

Impact:   A remote user can cause denial of service on the target TCP session. The specific impact depends on the specific vendor implementation.
Solution:   Fixes for implementations from affected TCP/IP vendors will be reported in separate Alerts [see the Message History].
Cause:   State error

Message History:   This archive entry has one or more follow-up message(s) listed below.
Apr 20 2004 (Juniper Issues Fix for ScreenOS) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Juniper has issued a fix for NetScreen ScreenOS.
Apr 20 2004 (Cisco Issues Fix for IOS and IOS Firewall) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Cisco has released a fix for Cisco IOS.
Apr 21 2004 (Cisco Plans Fix for Catalyst) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Cisco plans to issue fixes for Catalyst.
Apr 21 2004 (Cisco Plans Fix for Aironet) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Cisco plans to issue a fix for Cisco Aironet.
Apr 21 2004 (Cisco Issues Revised Fix for PIX Firewall) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Cisco has issued a revised fix for Cisco PIX Firewall.
Apr 21 2004 (Cisco Plans Fix for ONS) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Cisco plans a fix for Cisco ONS.
Apr 21 2004 (Cisco Issues Fix for Cisco MDS) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Cisco has issued a fix for Cisco MDS 9000.
Apr 21 2004 (NetBSD Issues Fix) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
NetBSD has issued a fix.
Apr 21 2004 (Check Point Issues Fix for FireWall-1/VPN-1) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Check Point has issued a fix for FireWall-1/VPN-1.
Apr 21 2004 (Check Point Issues Fix for Provider-1) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Check Point has issued a fix for Provider-1.
May 1 2004 (Blue Coat Issues Fix for CacheOS) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Blue Coat Systems has issued a fix for CacheOS.
May 1 2004 (Blue Coat Issues Fix for SGOS) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Blue Coat has issued a fix for SGOS.
May 7 2004 (OpenBSD Issues Fix) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
OpenBSD has issued a fix.
May 19 2004 (HP Issues Recommendation For ProCurve Switches) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
HP issues recommendation for protecting ProCurve switches.
May 21 2004 (APC Issues Advisory) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
APC has issued an interim advisory with some recommendations.
Sep 29 2004 (SGI Issues Fix) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
SGI has released a fix for IRIX.
Dec 24 2004 (HP Issues Fix for Tru64) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
HP has issued a fix for HP Tru64 UNIX.
Apr 12 2005 (Microsoft Issues Fix for Windows) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Microsoft has issued a fix for Windows
May 3 2005 (Symantec Gateway Security Fix is Available) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
A fix is available for Symantec Gateway Security.
Oct 10 2006 (Microsoft Issues Fix) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Microsoft has issued a fix for the IPv6 stack on Windows XP SP2 and 2003 SP1.
Jul 11 2014 (Juniper Issues Fix for Junos) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Juniper has issued a fix for Juniper Junos.
Sep 17 2014 (FreeBSD Issues Fix) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
FreeBSD has issued a fix for FreeBSD 8.4, 9.1, 9.2, 9.3, and 10.0.
Jan 21 2015 (Oracle Issues Fix for Solaris) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Oracle has issued a fix for Oracle Solaris 10 and 11.
May 6 2016 (Brocade Communications Systems Issues Fix for Brocade 5600 vRouter) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
Brocade Communications Systems has issued a fix for Brocade 5600 vRouter.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC