HP Path MTU Discovery DoS Vulnerability
BID:944
Info
HP Path MTU Discovery DoS Vulnerability
| Bugtraq ID: | 944 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 24 2000 12:00AM |
| Updated: | Jan 24 2000 12:00AM |
| Credit: | This vulnerability was published in a Hewlett-Packard Company Security Advisory, Number 00110, also known as HPSBUX0001-110, on January 24, 2000. |
| Vulnerable: |
HP HP-UX 11.0 HP HP-UX 10.30 |
| Not Vulnerable: |
HP HP-UX 10.20 |
Discussion
HP Path MTU Discovery DoS Vulnerability
A potential denial of service exists in Hewlett-Packard's proprietary protocol for discovering the maximum path MTU (PMTU) for a give connection. This feature could potentially be used to cause denial of services, using HPUX machines as "amplifiers." Essentially, HP machines which are vulnerable can, under certain conditions, be coerced in to sending far more data outbound than they receive inbound. By forging source addresses, it is possible to send a small quantity of packets purporting to be from a given source, and cause the HPUX machine to send multiple packets in response. This could potentially be used as a denial of service.
HP's proprietary path discover protocol works by sending data in parallel with ICMP packets being used for path discovery. While exact details of the nature of the denial of service were not made public, presumably it could be possible to utilize UDP packets, and default UDP services to start the chain of events leading to a denial of service
A potential denial of service exists in Hewlett-Packard's proprietary protocol for discovering the maximum path MTU (PMTU) for a give connection. This feature could potentially be used to cause denial of services, using HPUX machines as "amplifiers." Essentially, HP machines which are vulnerable can, under certain conditions, be coerced in to sending far more data outbound than they receive inbound. By forging source addresses, it is possible to send a small quantity of packets purporting to be from a given source, and cause the HPUX machine to send multiple packets in response. This could potentially be used as a denial of service.
HP's proprietary path discover protocol works by sending data in parallel with ICMP packets being used for path discovery. While exact details of the nature of the denial of service were not made public, presumably it could be possible to utilize UDP packets, and default UDP services to start the chain of events leading to a denial of service
Solution / Fix
HP Path MTU Discovery DoS Vulnerability
Solution:
The vendor recommends the following action:
Reference ndd manpage (1M), /etc/rc.config.d/nddconf
To ensure that this parameter is set each time the system is booted, add the following lines to /etc/rc.config.d/nddconf
TRANSPORT_NAME[<index>]=ip
NDD_NAME[<index>]=ip_pmtu_strategy
NDD_VALUE[<index>]=1
The value of <index> is an integer from 0 to 99. The first parameter specified in the file should use an <index> of 0, the second an <index> of 1, and so on.
Once these changes have been made, execute the following command:
/usr/bin/ndd -c
This sets all of the options specified in the file /etc/rc.config.d/nddconf.
To verify that the parameter is set correctly, use the following command.
/usr/bin/ndd -get /dev/ip ip_pmtu_strategy
This should report a value of 1.
Another way to change the ip_pmtu_strategy parameter on a running system is to use the following NDD command:
/usr/bin/ndd -set /dev/ip ip_pmtu_strategy 1
This setting will only last until the system is rebooted at which point the value of the parameter will be determined by the default value of 2 or whatever value is set in /etc/rc.config.d/nddconf
Solution:
The vendor recommends the following action:
Reference ndd manpage (1M), /etc/rc.config.d/nddconf
To ensure that this parameter is set each time the system is booted, add the following lines to /etc/rc.config.d/nddconf
TRANSPORT_NAME[<index>]=ip
NDD_NAME[<index>]=ip_pmtu_strategy
NDD_VALUE[<index>]=1
The value of <index> is an integer from 0 to 99. The first parameter specified in the file should use an <index> of 0, the second an <index> of 1, and so on.
Once these changes have been made, execute the following command:
/usr/bin/ndd -c
This sets all of the options specified in the file /etc/rc.config.d/nddconf.
To verify that the parameter is set correctly, use the following command.
/usr/bin/ndd -get /dev/ip ip_pmtu_strategy
This should report a value of 1.
Another way to change the ip_pmtu_strategy parameter on a running system is to use the following NDD command:
/usr/bin/ndd -set /dev/ip ip_pmtu_strategy 1
This setting will only last until the system is rebooted at which point the value of the parameter will be determined by the default value of 2 or whatever value is set in /etc/rc.config.d/nddconf
References
HP Path MTU Discovery DoS Vulnerability
References:
References:
- HP Support (Hewlett Packard)
- Welcome to Hewlett Packard (Hewlett Packard)