IPFilter TCP ACK/Bad Checksum Packet Denial Of Service Vulnerability
BID:6534
Info
IPFilter TCP ACK/Bad Checksum Packet Denial Of Service Vulnerability
| Bugtraq ID: | 6534 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 06 2003 12:00AM |
| Updated: | Jan 06 2003 12:00AM |
| Credit: | Discovery of this issue is credited to "Yiming Gong" <[email protected]>. |
| Vulnerable: |
Darren Reed IPFilter 3.4.30 Darren Reed IPFilter 3.4.29 |
| Not Vulnerable: | |
Discussion
IPFilter TCP ACK/Bad Checksum Packet Denial Of Service Vulnerability
IPFilter is prone to a denial of service when handling specially crafted packets.
When IPFilter handles a TCP ACK packet (without a previous SYN packet to initiate the session) that has a bad checksum, it will add an "ESTABLISHED" session to its state table, which will time out in 120 hours.
If numerous packets of this nature are sent, this may cause a denial of service as the state table will be filled with these sessions.
This issue is known to occur when "keep state" rules are used without "flags S". The vendor advises users against employing this configuration. It is possible to trigger this condition with other packet sequences.
IPFilter is prone to a denial of service when handling specially crafted packets.
When IPFilter handles a TCP ACK packet (without a previous SYN packet to initiate the session) that has a bad checksum, it will add an "ESTABLISHED" session to its state table, which will time out in 120 hours.
If numerous packets of this nature are sent, this may cause a denial of service as the state table will be filled with these sessions.
This issue is known to occur when "keep state" rules are used without "flags S". The vendor advises users against employing this configuration. It is possible to trigger this condition with other packet sequences.
Exploit / POC
IPFilter TCP ACK/Bad Checksum Packet Denial Of Service Vulnerability
There is no exploit code required.
There is no exploit code required.
Solution / Fix
IPFilter TCP ACK/Bad Checksum Packet Denial Of Service Vulnerability
Solution:
The vendor has stated that future versions will attempt to address this issue by modifying IPFilter to make more effort to free up state tables once they are full.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
The vendor has stated that future versions will attempt to address this issue by modifying IPFilter to make more effort to free up state tables once they are full.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
IPFilter TCP ACK/Bad Checksum Packet Denial Of Service Vulnerability
References:
References:
- ipfilter denial of service problem ("Yiming Gong"