Feature: OpenBSD Hackathon 2005, Part III

One new attendee of this year's OpenBSD hackathon was Fernando Gont, a diverse individual from Argentina whose current job titles include teacher, technical writer, system administrator and network researcher. His presence at the hackathon was the result of an internet-draft he wrote about some...

CVE-2005-0039

CVE-2005-0039 describes vulnerabilities in IPsec configurations where using ESP in tunnel mode (with CBC mode) or AH without proper integrity protections allows an attacker to modify the outer packet and cause the inner, encrypted data to be exposed in plaintext via ICMP messages. The attacks inc...

CVE-2005-0039

Certain configurations of IPsec, when using Encapsulating Security Payload ESP in tunnel mode, integrity protection at a higher layer, or Authentication Header AH, allow remote attackers to decrypt IPSec communications by modifying the outer packet in ways that cause plaintext data from the inner...

IPSec information leak

If ESP is used without integrity control it's possible to obtain plaintext data in ICMP error meesage by modifying source packet...

NISCC Vulnerability Advisory IPSEC - 004033

Abstract: Three attacks that apply to certain configurations of IPsec have been identified. These configurations use Encapsulating Security Payload ESP in tunnel mode with confidentiality only, or with integrity protection being provided by a higher layer protocol. Some configurations using AH to...

CVE-2005-0039: Undefined Security Weakness

Certain configurations of IPsec, when using Encapsulating Security Payload ESP in tunnel mode, integrity protection at a higher layer, or Authentication Header AH, allow remote attackers to decrypt IPSec communications by modifying the outer packet in ways that cause plaintext data from the inner...

IPsec configurations may be vulnerable to information disclosure

Overview The IPsec Encapsulating Security Payload protocol used in tunneling mode may be vulnerable to multiple attacks when confidentiality mode is used without integrity protection, or in certain cases where integrity protection is provided by higher-level protocols. Description The IP Security...

CVE-2005-0065

The original design of TCP does not check that the TCP sequence number in an ICMP error message is within the range of sequence numbers for data that has been sent but not acknowledged aka "TCP sequence number checking", which makes it easier for attackers to forge ICMP error messages for specifi...

Multiple OS (win32/aix/cisco) Crafted ICMP Messages DoS Exploit

Exploit for multiple platform in category dos / poc =============================================================== Multiple OS win32/aix/cisco Crafted ICMP Messages DoS Exploit =============================================================== / HOD-icmp-attacks-poc.c: 2005-04-15: PUBLIC v.0.2...

Multiple OS (win32/aix/cisco) Crafted ICMP Messages DoS Exploit

No description provided by source. / HOD-icmp-attacks-poc.c: 2005-04-15: PUBLIC v.0.2 Copyright c 2004-2005 houseofdabus. MS05-019 CISCO:20050412 ICMP attacks against TCP Proof-of-Concept .:: houseofdabus ::. for more details: http://www.livejournal.com/users/houseofdabus...

Multiple OS (Win32AixCisco) - Crafted ICMP Messages Denial of Service (MS05-019)

Multiple OS Win32AixCisco - Crafted ICMP Messages Denial of Service MS05-019 / HOD-icmp-attacks-poc.c: 2005-04-15: PUBLIC v.0.2 Copyright c 2004-2005 houseofdabus. MS05-019 CISCO:20050412 ICMP attacks against TCP Proof-of-Concept .:: houseofdabus ::. for more details:...

Multiple OS (Win32/Aix/Cisco) - Crafted ICMP Messages Denial of Service (MS05-019)

/ HOD-icmp-attacks-poc.c: 2005-04-15: PUBLIC v.0.2 Copyright c 2004-2005 houseofdabus. MS05-019 CISCO:20050412 ICMP attacks against TCP Proof-of-Concept .:: houseofdabus ::. for more details: http://www.livejournal.com/users/houseofdabus...

CVE-2004-1060

CVE-2004-1060 enables a denial-of-service via forged ICMP PMTU-discovery packets that degrade TCP throughput. Connected advisories show affected BIG-IP products and data-plane components; vulnerable versions include BIG-IP LTM/AAM/AFM/etc. for 10.x–11.x releases (e.g., 11.0.0–11.6.0, 10.0.0–10.2....

CVE-2004-0790

CVE-2004-0790 describes a denial-of-service condition caused by spoofed ICMP error messages that disrupt TCP connections. In published connected materials, the vulnerability is tied to BIG-IP products, notably FastL4 accelerated virtual servers on ePVA-equipped platforms (e.g., VIPRION blades and...

CVE-2004-0791

CVE-2004-0791 covers a denial-of-service scenario where multiple TCP/IP and ICMP implementations can be disrupted by a blind throughput-reduction attack using spoofed Source Quench packets. The CVE is discussed across connected advisories; notably, F5 David advisories show that for BIG-IP product...

CVE-2004-0790

Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service reset TCP connections via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks;...

CVE-2004-0791

Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service network throughput reduction for TCP connections via a blind throughput-reduction attack using spoofed Source Quench packets, aka the "ICMP Source Quench attack." NOTE: CVE-2004-0790, CVE-2004-0791, and...

CVE-2004-1060

Multiple TCP/IP and ICMP implementations, when using Path MTU PMTU discovery PMTUD, allow remote attackers to cause a denial of service network throughput reduction for TCP connections via forged ICMP "Fragmentation Needed and Don't Fragment was Set" packets with a low next-hop MTU value, aka the...

Microsoft Windows TCP/IP stack multiple vulnerabilities

Memory corruption on IP packets handling, TCP connection reset with spoofed TCP and ICMP packets, a varinat of LAND attack...

[Full-disclosure] Cisco Security Advisory: Crafted ICMP Messages Can Cause Denial of Service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Crafted ICMP Messages Can Cause Denial of Service Revision 1.0 For Public Release 2005 April 12 1200 UTC GMT +---------------------------------------------------------------------- Contents ======== Summary Affected Products...