Re: known TCP vulnerability ??

From: Andre Oppermann <oppermann_at_networx.ch>
Date: Fri, 11 Feb 2005 21:19:16 +0100
"Li, Qing" wrote:
> 
>         http://www.kb.cert.org/vuls/id/464113
> 
>         http://www.linuxsecurity.com/content/view/104980/98/
> 
>         Ran the packet tests against FreeBSD 5.3 and 6-CURRENT and both
>         respond to the SYN+FIN packets with SYN+ACK.

This is expected behaviour because of FreeBSD used to implement T/TCP
according to RFC1644.  I haven't removed this part from TCP because
I have a better reincarnation of T/TCP without the previous shortcomings
almost ready which uses this again.

The CERT article describes how dumb firewalls with poor stateful
inspection may get fooled by this and other flag combinations.
All I can say is it's not our fault.  The SYN+FIN combination is
described in RFC1644 and if the firewall gets it wrong...  Well,
the real world sucks.

>         Should I file a PR if there isn't one already ??

No action required here.

What you could check is whether our firewalls packages in stateful
mode (ipfw, pf, ipfilter) can be fooled by this.  I doubt it but
if you can verify it, that would be great.

-- 
Andre
Received on Fri Feb 11 2005 - 19:19:19 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:38:28 UTC