FreeBSD-SA-05:15.tcp "TCP connection stall denial of service"

t ! security

The FreeBSD Project よりセキュリティ勧告が出ました。要点を以下にまとめます。

  • 未稿

セキュリティ勧告は ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:15.tcp.asc にあります。
以下は上記のセキュリティ勧告の一部とその訳文です。ただし品質は保証致しません。

I. 背景 - Background

The Transmission Control Protocol (TCP) of the TCP/IP protocol suite provides a connection-oriented, reliable, sequence-preserving data stream service. TCP timestamps are used to measure Round-Trip Time and in the Protect Against Wrapped Sequences (PAWS) algorithm. TCP packets with the SYN flag set are used during setup of new TCP connections.

II. 問題の詳細 - Problem Description

Two problems have been discovered in the FreeBSD TCP stack.
First, when a TCP packets containing a timestamp is received, inadequate checking of sequence numbers is performed, allowing an attacker to artificially increase the internal "recent" timestamp for a connection.
Second, a TCP packet with the SYN flag set is accepted for established connections, allowing an attacker to overwrite certain TCP options.

III. 影響範囲 - Impact

Using either of the two problems an attacker with knowledge of the local and remote IP and port numbers associated with a connection can cause a denial of service situation by stalling the TCP connection. The stalled TCP connection my be closed after some time by the other host.

IV. 回避方法 - Workaround

In some cases it may be possible to defend against these attacks by blocking the attack packets using a firewall. Packets used to effect either of these attacks would have spoofed source IP addresses.

><