bugtraq - Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6.2.0.14.0.20050722000220.02030020@pop.frh.utn.edu.ar>
Date: Fri, 22 Jul 2005 00:04:52 -0300
From: Fernando Gont <fernando@....utn.edu.ar>
To: Casper.Dik@....COM,Darren Reed <avalon@...igula.anu.edu.au>
Cc: full-disclosure@...ts.grok.org.uk, Security Alert <secure@...hs.cup.hp.com>,
	bugtraq@...urityfocus.com
Subject: Re: (ICMP attacks against TCP) (was Re:
	HPSBUX01137 SSRT5954

At 02:17 p.m. 21/07/2005, Casper.Dik@....COM wrote:

> >> There are still some radio links with MTUs of 296 bytes.
> >
> >Go search with google....people still actively use smaller MTUs.
> >
> >What do you do?  Where do you draw the line in the sand?
>
>Well, the minimum requirement for "you must be able to reassemble this"
>is 576; so you use PMTU until you go as low as 576 at which point you
>stop using the DF bit

I assume you are not proposing this as the solution to the problem.

If you do, I'd just spoof an ICMP "fragmentation needed and DF bit set" 
that advertises an MTU lower than 576.
And then would attack you with IP fragments.

Kindest regards,

--
Fernando Gont
e-mail: fernando@...t.com.ar || fgont@....org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/