Date: Thu, 28 Mar 2024 20:59:46 -0400 (EDT) Message-ID: <300161383.531.1711673986889@windcrest.sei.cmu.edu> Subject: Exported From Confluence MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_Part_530_504951522.1711673986887" ------=_Part_530_504951522.1711673986887 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Content-Location: file:///C:/exported.html
A complete revision history is at the end of this file.
The CERT Coordination Center has received reports of two attack tools (T= eardrop and Land) that are being used to exploit two vulnerabilities in the= TCP/IP protocol. Both tools enable a remote user to cause a denial of serv= ice.
The CERT/CC team recommends installing patches from your vendor. Until y= ou are able to do so, we urge you to use the workaround described in Sectio= n III.B. to reduce the likelihood of a successful attack using Land. There = is no workaround for Teardrop.
We will update this advisory as we receive additional information. Pleas= e check our advisory files regularly for updates that relate to your site.<= /p>
In recent weeks there has been discussion on public mailing lists about = two denial-of-service attack tools, Teardrop and Land. These attack tools h= ave similar effects on some systems (namely, causing the victim machine to = crash), but the tools exploit different vulnerabilities.
The CERT Coordination Center has received several reports of sites being= attacked by either one or both of these tools. It is important to note tha= t it may be necessary for a system administrator to apply separate patches,= if they exist, for each attack tool.
Some implementations of the TCP/IP IP fragmentation re-assembly code do = not properly handle overlapping IP fragments. Teardrop is a widely availabl= e attack tool that exploits this vulnerability.
Some implementations of TCP/IP are vulnerable to packets that are crafte= d in a particular way (a SYN packet in which the source address and port ar= e the same as the destination--i.e., spoofed). Land is a widely available a= ttack tool that exploits this vulnerability.
Any remote user can crash a vulnerable machine.
Any remote user that can send spoofed packets to a host can crash or "ha= ng" that host.
CERT/CC urges you to immediately apply vendor patches if they are availa= ble. You may have to apply different patches for each attack tool.
You may want to use the workaround for Land, so please review both Secti= ons A and B below.
Appendix A contains information from vendors who provided input for this= advisory. We will update the appendix as we receive more information. If y= ou do not see your vendor's name, the CERT/CC did not hear from that vendor= . Please contact your vendor directly.
It is important to note that you may have to apply different patches for= each attack tool.
A workaround for the Land attack tool is to block IP-spoofed packets. Th= is workaround does not apply to the Teardrop attack tool because the Teardr= op attack does not rely on IP-spoofed packets.
Attacks like those of the Land tool rely on the use of forged packets, t= hat is, packets where the attacker deliberately falsifies the origin addres= s. With the current IP protocol technology, it is impossible to eliminate I= P-spoofed packets. However, you can reduce the likelihood of your site's ne= tworks being used to initiate forged packets by filtering outgoing packets = that have a source address different from that of your internal network.
Currently, the best method to reduce the number of IP-spoofed packets ex= iting your network is to install filtering on your routers that requires pa= ckets leaving your network to have a source address from your internal netw= ork. This type of filter prevents a source IP spoofing attack from your sit= e by filtering all outgoing packets that contain a source address from a di= fferent network.
A detailed description of this type of filtering is available in RFC 226= 7, "Network Ingress Filtering: Defeating Denial of Service Attacks which em= ploy IP Source Address Spoofing" by Paul Ferguson of Cisco Systems, Inc. an= d Daniel Senie of Blazenet, Inc. We recommend it to both Internet Service P= roviders and sites that manage their own routers. The document is currently= available at
Below is a list of the vendors who have provided information for this ad= visory. We will update this appendix as we receive additional information. = If you do not see your vendor's name, the CERT/CC did not hear from that ve= ndor. Please contact the vendor directly.
No version of BSD/OS is vulnerable to Teardrop.
Patched versions of 2.1 and all 3.0 and 3.1 versions are also not vulner= able to Land.
Topic 1 - Teardrop
Unless patched, Linux 2.0.x kernels prior to 2.0.32 are vulnerable. With= the application of the kernel update described in Caldera Security Advisor= y SA-1997.29 (dated 3-Dec-1997), Caldera OpenLinux is not vulnerable. This = Caldera advisory describes how to obtain and install the update and can be = found at:
htt= p://www.caldera.com/tech-ref/security/SA-1997.29.html
Other Caldera Security Advisories can be found at:
http://www.caldera= .com/tech-ref/security/
Topic 2 - Land
There are no known reports of any version of the Linux kernel, including= those shipping with Caldera OpenLinux, being vulnerable to this exploit.= p>
Not vulnerable.
Topic 2 - Land
IOS/7000 software, Catalyst 5xxx and 29xx LAN switches, BPX and IGX WAN = switches and AXIS shelf appear to be vulnerable. PIX firewall and Centri fi= rewall are not vulnerable.
For more information reference URL:
http://www.cisco.com/warp/public/770/land-pu=
b.shtml
CSRG 4.4 is not vulnerable.
Topic 2 - Land
No feedback.
Description: Security Vulnerability with land on HP-UX
The problem can be fixed by applying the appropriate cumulative ARPA Tra= nsport patch mentioned below.
=20 HP-UX release 11.00 HP9000 Series 700/800 PHNE_14017 HP-UX release 10.30 HP9000 Series 700/800 PHNE_13671 HP-UX release 10.20 HP9000 Series 800 PHNE_13468 HP-UX release 10.24 HP9000 Series 700 PHNE_13888 HP-UX release 10.24 HP9000 Series 800 PHNE_13889 HP-UX release 10.20 HP9000 Series 800 PHNE_13468 HP-UX release 10.20 HP9000 Series 700 PHNE_13469 HP-UX release 10.16 HP9000 Series 700 PHKL_14242 HP-UX release 10.16 HP9000 Series 800 PHKL_14243 HP-UX release 10.10 HP9000 Series 800 PHNE_13470 HP-UX release 10.10 HP9000 Series 700 PHNE_13471 HP-UX release 10.01 HP9000 Series 800 PHNE_13472 HP-UX release 10.01 HP9000 Series 700 PHNE_13473 HP-UX release 10.00 HP9000 Series 800 PHNE_13474 HP-UX release 10.00 HP9000 Series 700 PHNE_13475 HP-UX release 9.04 HP9000 Series 800 PHNE_13476 HP-UX release 9.0[3,5,7] HP9000 Series 700 PHNE_13477 HP-UX release 9.01 HP9000 Series 700 PHNE_13478 HP-UX release 9.00 HP9000 Series 800 PHNE_13479
AIX is not vulnerable.
Topic 2 - Land
AIX is not vulnerable.
Windows NT 4.0 with SP 3 and post SP 3 fixes applied and Windows 95 with=
the appropriate patch are not vulnerable.
Patch information is available at URL:
ftp://ftp.microsoft.com/bussys/winnt/kb/Q=
154/1/74.TXT
Topic 2 - Land
Windows NT 4.0 with the appropriate patch is not vulnerable.
Patch information is available at URL:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/ho=
tfixes-postSP3/land-fix/Q165005.txt
Windows 95 without the WinSock 2.0 Update is not vulnerable.
Patch information is available at URL:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/ho=
tfixes-postSP3/land-fix/Q177539.TXT
NCR MP-RAS TCP/IP implementation is not vulnerable.
Topic 2 - Land
Apply a patch for your MP-RAS UNIX TCP/IP depending on the revision of t= he inet package installed on your system. To check its version execute:
pkginfo -x inet
For inet 5.01.xx.xx: - PINET501 (Version later than 05.01.01.08)
For inet 6.01.xx.xx. - Not vulnerable.
For inet 6.02.xx.xx. - Not vulnerable.
Topic 1 - Teardrop
Versions 1.2 and above are not vulnerable.
Topic 2 - Land
Versions prior to 1.3_BETA will hang. 1.3_BETA and later versions are no= t vulnerable.
Linux is not vulnerable.
Topic 2 - Land
Linux is not vulnerable.
All releases of Solaris are not vulnerable. All supported versions of Su= nOS 4.1.x (4.1.3_U1 and 4.1.4) are not vulnerable.
Topic 2 - Land
All releases of Solaris are not vulnerable. SunOS 4.1.3_U1 and 4.1.4 are vulnerable. The following patches should be installed: =20 SunOS version Patch Id ------------- -------- =20 4.1.4 102517-05 4.1.3_U1 102010-06 =20 Sun recommended and security patches (including checksums) are available fr= om: =20 http://sunsolve.sun.com/sunsolve/pubpatches/patches.html
The CERT Coordination Center thanks Paul Ferguson and Daniel Senie for p= roviding information on network ingress filtering.
Copyright 1997, 1998 Carnegie Mellon University.
May 26, 1998 Updated vendor information for Sun Microsystems, Inc. Apr. 28, 1998 Corrected URL for obtaining RFCs. Mar. 10, 1998 Updated vendor information for Hewlett-Packard. Jan. 29, 1998 Updated reference to the filtering document (now an RFC) in S= ection III.B. Jan. 22, 1998 Updated vendor information for Hewlett-Packard. Jan. 15, 1998 Updated vendor information for Cisco Systems (Teardrop topic)= . Jan. 5, 1998 Updated vendor information for NetBSD. Dec. 17, 1997 Added or updated vendor information for Caldera, NCR, BSDI, and Sun. Dec. 16, 1997 Added vendor information for Digital Equipment Corporation and Hewlett-Packard.