Foundry Networks ServerIron TCP/IP Sequence Predictability Vulnerability
BID:1017
Info
Foundry Networks ServerIron TCP/IP Sequence Predictability Vulnerability
| Bugtraq ID: | 1017 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 28 2000 12:00AM |
| Updated: | Feb 28 2000 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list by Andrew van der Stock <[email protected]> on February 28, 2000. |
| Vulnerable: |
Foundry Networks ServerIron 6.0 Foundry Networks ServerIron 5.1.10 t12 |
| Not Vulnerable: | |
Discussion
Foundry Networks ServerIron TCP/IP Sequence Predictability Vulnerability
The ServerIron switch product, from Foundry Networks, suffers from a sequence predictable TCP implementation. This can open it up to a variety of session hijacking, and blind session spoofing attacks, which can result in the manipulation of these switches.
The ServerIron exposes telnet, snmp, and in newer versions, web servers on its management address. As a result of sequence predictability, it becomes possible to spoof connections to the TCP services (telnet and web) as if they originate from another machine. In addition, it exposes these switches to hijacking based attacks.
The problem lies in the fact that the initial sequence number (ISN) is incremented by one for each connection. This means that determining the "next" sequence number requires only the establishment of a connection.
The ServerIron switch product, from Foundry Networks, suffers from a sequence predictable TCP implementation. This can open it up to a variety of session hijacking, and blind session spoofing attacks, which can result in the manipulation of these switches.
The ServerIron exposes telnet, snmp, and in newer versions, web servers on its management address. As a result of sequence predictability, it becomes possible to spoof connections to the TCP services (telnet and web) as if they originate from another machine. In addition, it exposes these switches to hijacking based attacks.
The problem lies in the fact that the initial sequence number (ISN) is incremented by one for each connection. This means that determining the "next" sequence number requires only the establishment of a connection.
Exploit / POC
Foundry Networks ServerIron TCP/IP Sequence Predictability Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Foundry Networks ServerIron TCP/IP Sequence Predictability Vulnerability
Solution:
Foundry has issued a response to the vulnerabilities descibed. That document is available at:
http://www.foundrynet.com/bugTraq.html
A firmware upgrade, 6.0.03 has been issued which remedies some of the problems presented, as well as adding the ability to run sshd on the machine.
A short term solution may be to add ACL's to prevent any machine, except for a trusted one, to connect to the switch. Another possible solution is to disable all services on the switch, and only administer it from its serial console.
Solution:
Foundry has issued a response to the vulnerabilities descibed. That document is available at:
http://www.foundrynet.com/bugTraq.html
A firmware upgrade, 6.0.03 has been issued which remedies some of the problems presented, as well as adding the ability to run sshd on the machine.
A short term solution may be to add ACL's to prevent any machine, except for a trusted one, to connect to the switch. Another possible solution is to disable all services on the switch, and only administer it from its serial console.
References
Foundry Networks ServerIron TCP/IP Sequence Predictability Vulnerability
References:
References:
- ServerIron Information on BugTraq Posting (Foundry Networks)