Info

Last Modified

4 months ago

Percent Complete

100%

Disclosure

Apr 20, 2004

Discovery

Jul 30, 2003

Dates

Exploit

Unknown

Solution

Unknown

Description

The TCP stack implementation of numerous vendors contains a flaw that may allow a remote denial of service. The issue is triggered when spoofed TCP Reset packets are received by the targeted TCP stack, and will result in loss of availability for the attacked TCP services.

Classification

Location: Local Access Required, Remote/Network Access Required
Attack Type: Denial of Service, Hijacking, Infrastructure
Impact: Loss of Availability
Exploit: Exploit Available
Disclosure: OSVDB Verified

Technical

RFC-793 utilizes sequence checking to ensure proper ordering of received packets. RFC-793 requires that sequence numbers are checked against the window size before accepting data or control flags as valid. RFC-793 also specifies that RST control flags should be processed immediately, without waiting for out of sequence packets to arrive. Furthermore, RFC-793 allows a TCP implementation to verify both sequence and acknowledgement numbers prior to accepting a RST control flag as valid. No TCP stack implemention tested currently implements checking of both sequence and acknowledgement. All tested TCP stacks currently verify only the sequence number. This allows connections to be reset with dramatically less effort than previously believed.

This risk is compounded by the easy prediction of source port selection used in TCP connections.

Solution

Install vendor upgrades or patches to resolve this issue. Routers using BGP are highly recommended to implement RFC-2385 (BGP TCP MD5 Signatures) as a work-around.