lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: listuser at (Kurt Seifried)
Subject: Re: [VulnDiscuss] Re: [VulnWatch] TCP Reset Attacks: Paper and Code Now Availble

> Kurt Seifried wrote:
> > Please note:
> >
> > According to the Cisco presentation afterwards, Cisco's RST behavior
> > it non vulnerable as there is a wait period after a certain number of
> > RST packets are recieved. Thus Cisco IOS is basically not affected.

> So, this advisory on Cisco's site is a hoax? It states:
> "Products which contain a TCP stack are susceptible to this vulnerability.
> Cisco products and models are affected."

No, but the RST problem is ovr blown. See below for notes on the SYN related

> This is not quite true according to the advisiories.  You flood the
> other side with SYN segments (which are NOT rate limited).  Only if the
> segment number is acceptable, the other side generates an RST segment
> which tears down the connection.  RST rate limits do NOT help here.
> Even if you drop RST segments completely, the other side probably makes
> a state transition away from ESTABLISHED so that connection is
> eventually broken (I haven't tested this, but it's required according to
> RFC 793).
> The SYN issue is not present in the Watson's paper, by the way.  I don't
> know how he was able to attack those TCP connections with RST segments.
> Probably he didn't test an IOS-to-IOS TCP connection.

I specifically was replying to the RST issue, hence the no comment about

The thing to remember about the SYN issue is:

1) most systems/networks/etc have Syn flood protection in place since the
good old days of syn flooding started
2) if you can send several thousand or tens of thousands of Syn packets to
someone you can simply flood the BGP port on one end and have much the same
effect, without the need to guess the client end's port and a sequence
number. As the Cisco guy pointed out if you can generate this volume of
traffic you can pretty much DoS anything without the need to find the magic
sliding window.

Kurt Seifried,
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574

Powered by blists - more mailing lists