BSD PMTUD SYN-ACK Packet Fragmentation Fingerprinting Vulnerability

Bugtraq ID:	4688
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 06 2002 12:00AM
Updated:	Jun 06 2002 12:00AM
Credit:	Discovered by "Richie B." <[email protected]>.
Vulnerable:	FreeBSD FreeBSD 5.0 alpha FreeBSD FreeBSD 5.0
Not Vulnerable:

BSD PMTUD SYN-ACK Packet Fragmentation Fingerprinting Vulnerability

RFC 1191 documents Path MTU Discovery, which can be used to determine an approximate maximum MTU for IP based communications. In practice, when PMTUD is used in conjunction with TCP, the initial 3 way handshake is performed with the DF bit set on all packets.

Some versions of BSD have been reported to not set the DF bit on SYN-ACK packets. This could allow a malicious remote party to fingerprint the operating system of the vulnerable server by initating a connection and viewing captured network traffic.

This vulnerability has been reported in FreeBSD 5.0-CURRENT, however other BSD based operating systems may share this behavior. Updates will be released as additional information becomes available.

BSD PMTUD SYN-ACK Packet Fragmentation Fingerprinting Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

BSD PMTUD SYN-ACK Packet Fragmentation Fingerprinting Vulnerability

References:

• Path MTU Discovery and missing DF bit ("Richie B." )