Multiple Vendor TCP/IP Implementations Vulnerability
BID:120
Info
Multiple Vendor TCP/IP Implementations Vulnerability
| Bugtraq ID: | 120 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | Unknown |
| Published: | Dec 21 1998 12:00AM |
| Updated: | Dec 21 1998 12:00AM |
| Credit: | The vulnerability was originally discovered by Joel Boutros of the Enterprise Security Services team of Cambridge Technology Partners. Guido van Rooij of FreeBSD, Inc., provided an analysis of the vulnerability and information regarding its scope and exten |
| Vulnerable: |
OpenBSD OpenBSD 2.4 OpenBSD OpenBSD 2.3 OpenBSD OpenBSD 2.2 FreeBSD FreeBSD 2.2.2 FreeBSD FreeBSD 2.1.7 .1 FreeBSD FreeBSD 2.1.6 FreeBSD FreeBSD 2.1.5 FreeBSD FreeBSD 2.1 FreeBSD FreeBSD 2.0.5 FreeBSD FreeBSD 2.0 FreeBSD FreeBSD 1.1.5 .1 BSDI BSD/OS 3.1 |
| Not Vulnerable: |
FreeBSD FreeBSD 2.2.8 BSDI BSD/OS 4.0 |
Discussion
Multiple Vendor TCP/IP Implementations Vulnerability
On December 21/1998 the CERT Coordination Center released an advisory to announce a denial of service attack which affected some operating systems which relied on BSD derived TCP/IP stacks. While the advisory itself was remarkably vague inspection of the patches issued by the FreeBSD team seem to indicate the vulnerability was related to short packets with certian IP options set. The end result of such an attack resulted in the target box seizing up and ceasing active operation or in other instances a kernel panic and resulting reboot.
On December 21/1998 the CERT Coordination Center released an advisory to announce a denial of service attack which affected some operating systems which relied on BSD derived TCP/IP stacks. While the advisory itself was remarkably vague inspection of the patches issued by the FreeBSD team seem to indicate the vulnerability was related to short packets with certian IP options set. The end result of such an attack resulted in the target box seizing up and ceasing active operation or in other instances a kernel panic and resulting reboot.
Exploit / POC
Multiple Vendor TCP/IP Implementations Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Multiple Vendor TCP/IP Implementations Vulnerability
Solution:
If your operating system is one of those listed as vulnerable the following patches are known to be available:
Berkeley Software Design, Inc. (BSDI)
-------------------------------------------------------
BSD/OS 3.1 is vulnerable and a patch (M310-049) is available from BSDI's WWW server at: http://www.bsdi.com/support/patches
or via their ftp server from the directory:
ftp://ftp.bsdi.com/bsdi/patches/patches-3.1.
FreeBSD, Inc.
----------------------
FreeBSD 2.2.8 is not vulnerable. FreeBSD versions prior to 2.2.8 are vulnerable. FreeBSD 3.0 is also vulnerable. FreeBSD 3.0-current as of 1998/11/12 is not vulnerable.
A patch is available at:
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/CA-98-13/patch
OpenBSD
-----------------
OpenBSD 2.3:
http://www.openbsd.org/errata23.html#tcpfix
OpenBSD 2.4:
http://www.openbsd.org/errata.html#tcpfix
Solution:
If your operating system is one of those listed as vulnerable the following patches are known to be available:
Berkeley Software Design, Inc. (BSDI)
-------------------------------------------------------
BSD/OS 3.1 is vulnerable and a patch (M310-049) is available from BSDI's WWW server at: http://www.bsdi.com/support/patches
or via their ftp server from the directory:
ftp://ftp.bsdi.com/bsdi/patches/patches-3.1.
FreeBSD, Inc.
----------------------
FreeBSD 2.2.8 is not vulnerable. FreeBSD versions prior to 2.2.8 are vulnerable. FreeBSD 3.0 is also vulnerable. FreeBSD 3.0-current as of 1998/11/12 is not vulnerable.
A patch is available at:
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/CA-98-13/patch
OpenBSD
-----------------
OpenBSD 2.3:
http://www.openbsd.org/errata23.html#tcpfix
OpenBSD 2.4:
http://www.openbsd.org/errata.html#tcpfix
References
Multiple Vendor TCP/IP Implementations Vulnerability
References:
References: