TCP/IP implementations do not adequately validate ICMP error messages

Overview

Multiple TCP/IP implementations do not adequately validate ICMP error messages. A remote attacker could cause TCP connections to drop or be degraded using spoofed ICMP error messages.

Description

A number of widely accepted Internet standards describe different aspects of the relationships between the Internet Control Message Protocol (ICMP) and Transmission Control Protocol (TCP). In particular, RFC 1122 explains how TCP should respond to ICMP messages:

`

`4.2.3.9 ICMP Messages TCP MUST act on an ICMP error message passed up from the IP layer, directing it to the connection that created the error. The necessary demultiplexing information can be found in the IP header contained within the ICMP message. o Source Quench TCP MUST react to a Source Quench by slowing transmission on the connection. The RECOMMENDED procedure is for a Source Quench to trigger a “slow start,” as if a retransmission timeout had occurred. o Destination Unreachable – codes 0, 1, 5 Since these Unreachable messages indicate soft error conditions, TCP MUST NOT abort the connection, and it SHOULD make the information available to the application. DISCUSSION: TCP could report the soft error condition directly to the application layer with an upcall to the ERROR_REPORT routine, or it could merely note the message and report it to the application only when and if the TCP connection times out. o Destination Unreachable – codes 2-4 These are hard error conditions, so TCP SHOULD abort the connection. o Time Exceeded – codes 0, 1 This should be handled the same way as Destination Unreachable codes 0, 1, 5 (see above). o Parameter Problem This should be handled the same way as Destination Unreachable codes 0, 1, 5 (see above).
An ICMP message contains the IP header and the first 8 bytes of the transport layer (TCP) segment that caused the error condition (this covers IP and TCP header information). In order to match an ICMP message to a TCP connection, TCP stack implementations generally match the source and destination TCP port and IP address four-tuple from the data returned in the ICMP message. An attacker who knows or can guess this four-tuple can create spoofed ICMP messages. By setting ICMP types and codes to indicate hard or soft error conditions, the attacker may be able to cause valid TCP connections to be reset or degraded. An attacker may also be able to take advantage of path MTU discovery functionality by spoofing ICMP type 3 (Destination Unreachable) code 4 (Fragmentation Needed but Don’t Fragment Bit Set) messages and lowering the MTU for a connection (this is described in section 8 of RFC 1191).

Note that any protocols that use path MTU discovery and state-based transport layer protocols other than TCP could also be affected.

Further details about this vulnerability are available in an IETF Internet Draft titled “ICMP attacks against TCP” authored by Fernando Gont.

---

Impact

A remote attacker could cause TCP connections to drop or be degraded using spoofed ICMP error messages. Applications that depend on on long-lived, low latency, or high throughput TCP connections may not function correctly on a degraded TCP connection. In order to spoof an ICMP message, an attacker would need to know or guess the source and destination TCP port and IP address four-tuple. The Border Gateway Protocol (BGP) is of paticular concern since it relies on long-lived TCP connections (VU#415294), uses well-known source and destination ports, provides critical network and Internet routing information, and may require a non-trivial period of time to recover from a sustained attack.

---

Solution

Upgrade or apply a patch
Upgrade or apply a patch according to vendor instructions. Note that changes made by upgrades or patches may not completely defend against spoofed ICMP attacks. Consult vendor documentation for information on changes to ICMP message handling. Consider the general and attack-specific countermeasures discussed in the Gont I-D. Some of the countermesures include validating TCP sequence and acknowledgement numbers contained in ICMP messages, improving TCP ephemeral port number randomization, changing the response to or ignoring certain ICMP messages, and delaying connection resets. Note that different countermeasures have different constraints and may negatively impact TCP operations.

Filter ICMP messages

Filter ICMP messages based on type and code at network borders. Allow only ICMP messages that are necessary for proper operation.

IPsec and TCP MD5

Note that TCP MD5 does not provide authentication for ICMP messages. Current IPsec specifications do not define how IPsec implementations should handle ICMP messages destined for authenticated TCP connections.

---

Vendor Information

222750

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Alcatel __ Affected

Notified: August 12, 2004 Updated: September 08, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en&gt;.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Allied Telesyn International __ Affected

Updated: April 29, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

For customers in Japan, Allied Telesis K.K. which is a member of AT-Group has published a statement only for Japanese market. Please visit the following web sites.

<http://jvn.jp/niscc/532967/522154/index.html&gt; (Japanese)
<http://www.allied-telesis.co.jp/support/list/faq/vuls/vulsall.html&gt; (Japanese)

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Cisco Systems, Inc. __ Affected

Notified: August 12, 2004 Updated: April 12, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml&gt;.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Extreme Networks __ Affected

Notified: August 12, 2004 Updated: April 21, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Extreme Networks products running “Extremeware 7.x” software are vulnerable to this issue. Extreme Networks products running “Extremeware EXOS” software are not vulnerable.

Workaround: Apply filter to block ICMP packets with specific type/code which can cause the attack.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

F5 Networks, Inc. __ Affected

Notified: August 12, 2004 Updated: May 03, 2005

Status

Affected

Vendor Statement

F5 products BIG-IP 4.x and 9.x are vulnerable. Patches are being made ready. TrafficShield and FirePass are not vulnerable.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Further information is available in Secunia Advisory SA15205.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Hewlett-Packard Company __ Affected

Notified: August 12, 2004 Updated: September 08, 2005

Status

Affected

Vendor Statement

SOURCE: Hewlett-Packard CompanySoftware Security Response Team

x-ref:SSRT4884

HP is investigating the potential impact to HP’s products.

As further information becomes available HP will provide notice through standard security bulletin announcements.

To report potential security vulnerabilities in HP software, send an E-mail message to [email protected].

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see HPSBUX01164/SSRT4884 (HP-UX) and HPSBTU01210/SSRT4743 (HP Tru64 UNIX).

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Hitachi __ Affected

Notified: August 12, 2004 Updated: September 08, 2005

Status

Affected

Vendor Statement

[[VULNERABLE]<br>

Hitachi GR2000/GR4000/GS4000/GS3000 are vulnerable to this issue. More details are available at <<http://www.hitachi.co.jp/Prod/comp/network/notice/NISCC-532967.html&gt;&gt; (Japanese).]

[NOT VULNERABLE]
Alaxala AX series are NOT vulnerable.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en&gt; and <http://jvn.jp/niscc/532967/index.html&gt; (Japanese).

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

IBM Corporation __ Affected

Notified: August 12, 2004 Updated: April 12, 2005

Status

Affected

Vendor Statement

The AIX Operating System is affected by the issues discussed in CERT Vulnerability note VU#222750 and NISCC vulnerability #432967. An advisory for this issue will be available via <https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs&gt;

For information related to this and other published CERT Advisories that may relate to the IBM eServer Platforms (xSeries, iSeries, pSeries, and zSeries) please go to https://app-06.www.ibm.com/servers/resourcelink/lib03020.nsf/pages/securityalerts?OpenDocument&pathID=

In order to access this information you will require a Resource Link ID. To subscribe to Resource Link go to <http://app-06.www.ibm.com/servers/resourcelink&gt; and follow the steps for registration.

All questions should be refferred to [email protected].

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en&gt;.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Juniper Networks, Inc. __ Affected

Notified: August 12, 2004 Updated: May 05, 2005

Status

Affected

Vendor Statement

Juniper Networks M-series and T-series routers running software built prior to August 18, 2004, are susceptible to this vulnerability. Software built on or after that date disables processing of ICMP Source Quench messages, permits the user to disable Path MTU Discovery, and has additional verification enabled for PMTUD. The various forms of ICMP Unreachable messages are already ignored except during session establishment.

Other Juniper Networks products are not susceptible to this vulnerability. Customers should visit the Juniper Networks Customer Service Center web-site for further information:

<http://www.juniper.net/customers/csc&gt;

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en&gt; and <https://www.juniper.net/customers/csc&gt;.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Microsoft Corporation __ Affected

Notified: August 12, 2004 Updated: April 29, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see Microsoft Security Bulletin MS05-019.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Netfilter __ Affected

Notified: August 12, 2004 Updated: April 29, 2005

Status

Affected

Vendor Statement

The Linux kernel TCP/IP implementation has always been verifying the TCP sequence number embedded into the ICMP packet, and Linux end hosts are thus not affected by this vulnerability.

As for non-Linux machines protected by a netfilter/iptables firewall: netfilter/iptables did not implement TCP sequence number (aka window) tracking at all until linux-2.6.9.

However, even in linux >= 2.6.9, the check for RELATED ICMP packets does not verify the tcp sequence number of the encapsulated packet.

Implementation of such a check is scheduled for inclusion into the 2.6.11 linux kernel.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Network Appliance __ Affected

Notified: August 12, 2004 Updated: April 11, 2005

Status

Affected

Vendor Statement

The Data ONTAP operating system has historically implemented some, but not all, of the recommendations from <http://www.ietf.org/internet-drafts/draft-gont-tcpm-icmp-attacks-03.txt&gt;

NetApp has implemented the remaining recommendations under bug ID 138865. Customers may, as always, check bug status and download patches from <http://now.netapp.com/&gt;

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Nortel Networks, Inc. __ Affected

Notified: August 12, 2004 Updated: September 08, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see Nortel Technical Bulletins 2005005697, 2005005700, and 2005005701 on the Nortel Securitiy Advisory Bulletins site.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

OpenBSD __ Affected

Notified: August 12, 2004 Updated: April 21, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see 027: RELIABILITY FIX: August 25, 2004 for OpenBSD 3.4 and 015: RELIABILITY FIX: August 25, 2004 for OpenBSD 3.5.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Red Hat, Inc. __ Affected

Notified: August 12, 2004 Updated: April 12, 2005

Status

Affected

Vendor Statement

CAN-2004-0790: A blind TCP connection reset

Red Hat Enterprise Linux 2.1 and 3 kernels have always verified the TCP sequence number on ICMP errors. In addition Linux kernels will never abort a connection due to a received ICMP packet. All Red Hat Enterprise Linux versions are therefore unaffected by this issue.

CAN-2004-0791: A spoofing attack with ICMP type 4 header

Red Hat Enterprise Linux 2.1 and 3 kernels prior to January 2005 honour ICMP Source Quench messages, although the TCP sequence number is checked which substantially increases the amount of effort an attacker would need to be able to cause a sucessful attack. ICMP Source Quench messages were disabled completely by the following updates:

<http://rhn.redhat.com/errata/RHSA-2005-043.html&gt;
<http://rhn.redhat.com/errata/RHSA-2005-016.html&gt;
<http://rhn.redhat.com/errata/RHSA-2005-017.html&gt;
CAN-2004-1060: ICMP path MTU spoofing

Red Hat Enterprise Linux 2.1 and 3 kernels verify the sequence number on ICMP errors, thus significantly mitigating this issue. This issue can also be mitigated by disabling pmtu discovery if not required (/proc/sys/net/ipv4/ip_no_pmtu_disc)

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en&gt;.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Redback Networks Inc. __ Affected

Notified: August 12, 2004 Updated: April 12, 2005

Status

Affected

Vendor Statement

Like most of TCP implementations, both product lines of Redback Networks, Subscriber Management System and SmartEdge Router Family are affected by this vulnerability.

The fixes will be available on both platforms in upcoming releases.

For further assistance regarding this topic contact the Redback Networks Technical Assistance Center (TAC). TAC is prepared to provide worldwide support for security workarounds that address this issue. The Redback domestic TAC number is (877) 733 2225 and International TAC phone number is 31-104987777. Redback TAC will provide detailed information to our worldwide systems engineers and focal engineers to assist customers in configuring these workarounds.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

SCO __ Affected

Notified: August 12, 2004 Updated: April 12, 2005

Status

Affected

Vendor Statement

SCO is aware of the issue and is working on a fix.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

For UnixWare 7.1.4 the fix is included in maintenance pack 2:

<http://www.sco.com/support/update/download/release.php?rid=58&gt;

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Sun Microsystems, Inc. __ Affected

Notified: August 12, 2004 Updated: April 12, 2005

Status

Affected

Vendor Statement

Sun is only marginally impacted by the issues described in Gont’s ICMP Internet Draft as existing TCP connections will not be dropped. There may be a performance impact but no more or less than flooding any link or system with garbage messages will cause performance problems. Sun is issuing Sun Alert 57746 to further describe Sun’s specific impact and details which will be available here:

<http://sunsolve.sun.com/search/document.do?assetkey=1-26-57746-1&gt;

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Symantec Corporation __ Affected

Notified: August 12, 2004 Updated: May 03, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see SYM05-008.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

WatchGuard __ Affected

Notified: August 12, 2004 Updated: April 11, 2005

Status

Affected

Vendor Statement

All WatchGuard firewalls are impacted to some extent by Gont’s findings. TCP sessions which terminate on or pass through the firewall are vulnerable to reset attacks when the attacker can guess the source and destination address and port combinations for that session. WatchGuard plans to address the issues raised by Gont’s paper for all products in software releases currently scheduled for the Q2-Q3 2005 time frame. If you have further questions about this or any other security concern with WatchGuard products, please contact:

Steve Fallin
Director, Rapid Response Team
WatchGuard Technologies
<http://www.watchguard.com>
[email protected]
+1.206.521.8340

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Wind River Systems, Inc. __ Affected

Notified: August 12, 2004 Updated: April 12, 2005

Status

Affected

Vendor Statement

In all releases after VxWorks 5.3 a hard error does not result in TCP aborting the connection. The hard error code is saved by TCP. If the connection is dropped due to a timeout this error code is available to the application. Wind River Network Stack 2.0 already checks the ICMP sequence numbers. The release of VxWorks 6.0 and the MSP updates shipping in the fall of 2004 are based on this stack.

Wind River is planning updates to the VxWorks 5.5 and 5.4 versions of the stack that will include the fix for ICMP. These updates are planned for 2005.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en&gt;.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Check Point __ Not Affected

Notified: August 12, 2004 Updated: April 12, 2005

Status

Not Affected

Vendor Statement

Check Point products are not vulnerable to this issue.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en&gt;.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Clavister __ Not Affected

Notified: August 12, 2004 Updated: April 12, 2005

Status

Not Affected

Vendor Statement

Clavister Firewall is itself not vulnerable to this class of attacks. It also attempts to protect clients against such attacks.

Specifically:

* No ICMP errors are passed by default. They may however be allowed on a per-rule/service basis.
* The firewall's own TCP stack (used by internal processes and ALGs) does not listen ICMP errors at all.
* All sequence numbers are scrambled using a high quality random engine, making sequence number guessing harder.
* In the case of many-to-one (dynamic) NAT, source port numbers are allocated randomly, making source port number guessing harder. See draft-gont-tcpm-icmp-attacks-00 section 5.3
* On not accepting ICMP errors: The method outlined in draft-gont-tcpm-icmp-attacks-00 section 5.2 (delaying the connection reset) results in behavior not too dissimilar. The difference simply lies in how many packets that get sent before the connection is failed.
* PMTU discovery problems that normally arise by not accepting ICMP errors by default are avoided by doing DF bit stripping by default. 

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Cyber Guard __ Not Affected

Updated: April 12, 2005

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en&gt;.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Enterasys Networks __ Not Affected

Updated: June 15, 2005

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <<http://www.enterasys.com/support/security/advisories/222750.pdf&gt;&gt;

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Fedora Project __ Not Affected

Notified: August 12, 2004 Updated: April 12, 2005

Status

Not Affected

Vendor Statement

CAN-2004-0790: A blind TCP connection reset by sending

The Linux 2.4 and 2.6 kernels have always verified the TCP sequence number on ICMP errors. In addition Linux kernels will never abort a connection due to a received ICMP packet. All Fedora Core versions are therefore unaffected by this issue.

CAN-2004-0791: A spoofing attack with ICMP type 4 header

The Linux kernel since 2.6.9 and 2.4.28 has included a patch by Dave Miller to ignore ICMP Source Quench messages as recommended by Fernando Gont. Fedora Core 3 shipped with a 2.6.9 kernel which ignores ICMP Source Quench messages. Fedora Core 2 was updated to a 2.6.9 kernel in a November 2004 update and is therefore also unaffected by this issue.

CAN-2004-1060: ICMP path MTU spoofing

Linux 2.4 and 2.6 kernels verify the sequence number on ICMP errors, thus significantly mitigating this issue. This issue can also be mitigated by disabling pmtu discovery if not required (/proc/sys/net/ipv4/ip_no_pmtu_disc)

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en&gt;.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Fortinet __ Not Affected

Notified: August 12, 2004 Updated: April 21, 2005

Status

Not Affected

Vendor Statement

Fortinet does not have this problem.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Foundry Networks Inc. __ Not Affected

Notified: August 12, 2004 Updated: April 12, 2005

Status

Not Affected

Vendor Statement

Foundry’s implementation of ICMP on its products is not vulnerable to this type of attack.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Fujitsu __ Not Affected

Notified: August 12, 2004 Updated: September 08, 2005

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en&gt;, <http://software.fujitsu.com/jp/security/niscc/niscc.html#222750-tcpicmp&gt;, and <http://jvn.jp/niscc/532967/index.html&gt; (Japanese).

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Intoto __ Not Affected

Notified: August 12, 2004 Updated: February 07, 2005

Status

Not Affected

Vendor Statement

We analyzed the potential threats discussed in the IETF draft

draft-gont-tcpm-icmp-attacks-00.txt
and observed that Intoto products are not vulnerable to the described denial of service (DoS) attacks.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

NEC Corporation __ Not Affected

Notified: August 12, 2004 Updated: September 08, 2005

Status

Not Affected

Vendor Statement

NEC Corporation products are not susceptible to this vulnerability.

* We continue to check our products.
* For more detail:

<http://www.sw.nec.co.jp/psirt/index.html&gt; (Japanese)

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en&gt;.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Netscreen __ Not Affected

Notified: August 12, 2004 Updated: April 12, 2005

Status

Not Affected

Vendor Statement

Juniper Networks M-series and T-series routers running certain releases of JUNOS software are susceptible to this vulnerability. Other Juniper Networks products are not susceptible to this vulnerability. Customers should visit the Juniper Networks Customer Service Center web-site for further information.

<http://www.juniper.net/customers/csc&gt;

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Secure Computing Corporation __ Not Affected

Notified: August 12, 2004 Updated: April 12, 2005

Status

Not Affected

Vendor Statement

Secure Computing has carefully analyzed the scenarios outlined in the Internet Draft, and has determined that the Sidewinder G2 responds appropriately in those situations. Some of the scenarios mentioned in this draft illustrate again the desirability of using carefully configured security appliances and using protocols such as IPsec.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en&gt;.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

SecureWorks __ Not Affected

Updated: May 03, 2005

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Stonesoft __ Not Affected

Notified: August 12, 2004 Updated: April 12, 2005

Status

Not Affected

Vendor Statement

Stonesoft StoneGate Firewall and IPS products are not affected by these vulnerabilities.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en&gt;.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Tech Matrix __ Not Affected

Updated: April 29, 2005

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://jvn.jp/niscc/532967/index.html&gt; (Japanese).

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Yamaha __ Not Affected

Updated: April 29, 2005

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://jvn.jp/niscc/532967/index.html&gt; (Japanese).

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

3Com __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

AT&T __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Apple Computer, Inc. __ Unknown

Notified: August 12, 2004 Updated: April 12, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en&gt;. Apple Mac OS X versions prior to 10.2 may be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Avaya __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Avici Systems Inc. __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Borderware __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Charlotte’s Web Networks __ Unknown

Notified: August 12, 2004 Updated: September 08, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Chiaro Networks __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Computer Associates __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Cray Inc. __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Data Connection __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Debian Linux __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Dlink __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

EMC Corporation __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Engarde __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

FreeBSD, Inc. __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

GTA __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Hyperchip __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

IP Filter __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Immunix __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Ingrian Networks, Inc. __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Intel __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Lachman __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Linksys __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Lucent Technologies __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Luminous __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Mandriva, Inc. __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Mandriva, Inc. __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

MontaVista Software, Inc. __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Multi-Tech Systems Inc. __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Multinet __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

NetBSD __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Network Associates __ Unknown

Notified: August 12, 2004 Updated: April 12, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

NextHop __ Unknown

Notified: August 12, 2004 Updated: April 21, 2005

Status

Unknown

Vendor Statement

NextHop Technologies software does not include a TCP/IP stack. Instead, it relies on third party TCP/IP stacks. As a result, NextHop software is not directly affected by this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Nokia __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Novell, Inc. __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Openwall GNU/*/Linux __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Polycom Inc. __ Unknown

Updated: September 08, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en&gt; and the Security Headlines posted at the Polycom Security Center.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Riverstone Networks __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

SGI __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

SUSE Linux __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

SecureWorx __ Unknown

Notified: August 12, 2004 Updated: May 03, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Sequent Computer Systems, Inc. __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Sony Corporation __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

TurboLinux __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

Unisys __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

ZyXEL __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

eSoft __ Unknown

Notified: August 12, 2004 Updated: February 07, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23222750 Feedback>).

View all 85 vendors __View less vendors __

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html&gt;
• <http://tools.ietf.org/wg/opsec/draft-gont-opsec-icmp-filtering-00.txt&gt;
• <http://www.ietf.org/rfc/rfc792.txt&gt;
• <http://www.ietf.org/rfc/rfc1122.txt&gt;
• <http://www.ietf.org/rfc/rfc1191.txt&gt;
• <http://www.ietf.org/rfc/rfc1323.txt&gt;
• <http://www.ietf.org/rfc/rfc2385.txt&gt;
• <http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf&gt;
• <http://jvn.jp/niscc/532967/index.html&gt;
• <http://xforce.iss.net/xforce/xfdb/17170&gt;
• <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0790&gt;
• <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0791&gt;
• <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1060&gt;
• <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0065&gt;
• <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0066&gt;
• <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0067&gt;
• <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0068&gt;
• <http://www.securiteam.com/securitynews/5AP0D2A35U.html&gt;
• <http://www.ietf.org/internet-drafts/draft-ietf-tcpm-tcpsecure-02.txt&gt;
• <http://www.ietf.org/ietf/03mar/plpmtud.txt&gt;
• <http://www.psc.edu/~mathis/MTU/&gt;
• <http://www.cymru.com/Documents/icmp-messages.html&gt;
• <http://secunia.com/advisories/14904/&gt;
• <http://securitytracker.com/alerts/2005/Apr/1013686.html&gt;

Acknowledgements

Information about the security risks of ICMP messages has been known for some time (RFC 1191 was published in 1990). More recent work by Fernando Gont (Universidad Tecnológica Nacional - Facultad Regional Haedo) describes different types of ICMP attacks against TCP and proposes a number of defense techniques. Gont’s research is documented in an IETF Internet Draft titled “ICMP attacks against TCP” (revision 3 as of this writing). Jonathan Looney researched and reported a specific ICMP attack that affects TCP connections on Microsoft Windows systems.

This document was written by Art Manion.

Other Information

CVE IDs:	None
Severity Metric:	12.48 Date Public: