full-disclosure - Re: [VulnDiscuss] Re: [VulnWatch] TCP Reset Attacks: Paper and Code Now Availble

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040423131453.GA30717@Login.CERT.Uni-Stuttgart.DE>
From: Weimer at CERT.Uni-Stuttgart.DE (Florian Weimer)
Subject: Re: [VulnDiscuss] Re: [VulnWatch] TCP Reset Attacks: Paper and Code Now Availble

Kurt Seifried wrote:

> Please note:
> 
> According to the Cisco presentation afterwards, Cisco's RST behavior makes
> it non vulnerable as there is a wait period after a certain number of bad
> RST packets are recieved. Thus Cisco IOS is basically not affected.

This is not quite true according to the advisiories.  You flood the
other side with SYN segments (which are NOT rate limited).  Only if the
segment number is acceptable, the other side generates an RST segment
which tears down the connection.  RST rate limits do NOT help here.
Even if you drop RST segments completely, the other side probably makes
a state transition away from ESTABLISHED so that connection is
eventually broken (I haven't tested this, but it's required according to
RFC 793).

The SYN issue is not present in the Watson's paper, by the way.  I don't
know how he was able to attack those TCP connections with RST segments.
Probably he didn't test an IOS-to-IOS TCP connection.

-- 
Florian Weimer 	                  Weimer@...T.Uni-Stuttgart.DE
University of Stuttgart
ZENDAS                            fax +49-711-121-3688