Messages in this thread | | | Date | Tue, 14 Sep 2004 21:41:41 +0200 | From | Willy Tarreau <> | Subject | Re: Linux 2.4.27 SECURITY BUG - TCP Local and REMOTE(verified) Denial of Service Attack |
| |
Hi Alan,
On Tue, Sep 14, 2004 at 04:10:36PM +0100, Alan Cox wrote: > On Maw, 2004-09-14 at 15:55, Paul Jakma wrote: > > Hmm, yes, I hadnt thought of the attack-mitigating aspects of > > graceful restart. Though, without other measures, the session is > > still is open to abuse (send RST every second). > > Of course its much easier to just send "must fragment, size 68" icmp > replies and guess them that way. This is spectacularly more effective > and various vendors highly invalid rst acking crap won't save you.
Just wondering, I have not checked. Isn't the "must fragment" message supposed to embed part of the packet it couldn't send in return ? If this is the case (and if the victim processes it correctly), it would need to guess a recent valid content. If it's not the case, I suspect it would simply update the path mtu in the route cache, thus giving spectacular effects :-)
Cheers, Willy
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |