Multiple Vendor Smurf Denial of Service Vulnerability
BID:147
Info
Multiple Vendor Smurf Denial of Service Vulnerability
| Bugtraq ID: | 147 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 05 1998 12:00AM |
| Updated: | Jan 05 1998 12:00AM |
| Credit: | This vulnerability was originally posted to the Bugtraq mailing list on October 12, 1997, by T. Freak <[email protected]>. It included exploit code. CERT subsequently released an advisory on January 5, 1998. |
| Vulnerable: |
Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 NetBSD NetBSD 1.2 Linux kernel 2.1 Linux kernel 2.0 IBM AIX 3.2.5 IBM AIX 3.2.4 IBM AIX 3.2 IBM AIX 3.1 HP HP-UX 11.0 HP HP-UX 10.20 FreeBSD FreeBSD 2.2.4 FreeBSD FreeBSD 2.2.3 FreeBSD FreeBSD 2.2.2 FreeBSD FreeBSD 2.1.7 .1 FreeBSD FreeBSD 2.1.6 FreeBSD FreeBSD 2.1.5 FreeBSD FreeBSD 2.1 FreeBSD FreeBSD 2.0.5 FreeBSD FreeBSD 1.1.5 .1 Digital UNIX 4.0 D Digital UNIX 4.0 C Digital UNIX 4.0 B Digital UNIX 4.0 A Digital UNIX 4.0 Digital UNIX 3.2 G |
| Not Vulnerable: |
IBM AIX 4.3 IBM AIX 4.2 IBM AIX 4.1 FreeBSD FreeBSD 2.2.5 |
Discussion
Multiple Vendor Smurf Denial of Service Vulnerability
The "Smurf" denial of service exploits the existance, and forwarding of, packets sent to IP broadcast addreses. By creating an ICMP echo request packet, with the source address set to an IP within the network to be attacked, and the destination address the IP broadcast address of a network which will forward and respond to ICMP echo packets sent to broadcast. Each packet sent in to the network being used to conduct the attack will be responded to by any machine which will respond to ICMP on the broadcast address. Therefore, a single packet can result in an overwhelming response count, all of which are directed to the network the attacker has forged as the source. This can result in significant bandwidth loss.
The "Smurf" denial of service exploits the existance, and forwarding of, packets sent to IP broadcast addreses. By creating an ICMP echo request packet, with the source address set to an IP within the network to be attacked, and the destination address the IP broadcast address of a network which will forward and respond to ICMP echo packets sent to broadcast. Each packet sent in to the network being used to conduct the attack will be responded to by any machine which will respond to ICMP on the broadcast address. Therefore, a single packet can result in an overwhelming response count, all of which are directed to the network the attacker has forged as the source. This can result in significant bandwidth loss.
Exploit / POC
Solution / Fix
Multiple Vendor Smurf Denial of Service Vulnerability
Solution:
There are very few ways to prevent being at least partially vulnerable to the attack. Blocking the propagation of IICMP sent to the broadcast address at a border router will prevent your site from being used to stage the attack. Most firewalls will prevent this attack outright -- few allow ICMP echo to pass through in their default configuration, and those that do can be configured to prevent ICMP echo responses from entering the network when there is not a corresponding echo request. In addition, configuring individual machines to not respond to ICMP echo when sent to the broadcast will prevent scenarios where this attack can be used internally to a network.
CERT advisory CA-98.01.smurf has a number of helpful details, as well as configuration information for a number of affected systems. Those who believe they are vulnerable, and wish to take action, should refer to this advisory.
Solution:
There are very few ways to prevent being at least partially vulnerable to the attack. Blocking the propagation of IICMP sent to the broadcast address at a border router will prevent your site from being used to stage the attack. Most firewalls will prevent this attack outright -- few allow ICMP echo to pass through in their default configuration, and those that do can be configured to prevent ICMP echo responses from entering the network when there is not a corresponding echo request. In addition, configuring individual machines to not respond to ICMP echo when sent to the broadcast will prevent scenarios where this attack can be used internally to a network.
CERT advisory CA-98.01.smurf has a number of helpful details, as well as configuration information for a number of affected systems. Those who believe they are vulnerable, and wish to take action, should refer to this advisory.