120 matches found
Cisco IOS XE Crafted MPLS IP Fragmentation Denial of Service Vulnerability
A vulnerability in the Multiprotocol Label Switching MPLS IP fragmentation function of Cisco IOS XE could allow an unauthenticated, remote attacker to cause the Cisco Packet Processor to crash. The vulnerability is due to input validation processing of the crafted MPLS IP packets. An attacker cou...
Code injection
A certain pseudo-random number generator PRNG algorithm that uses XOR and 2-bit random hops aka "Algorithm X2", as used in OpenBSD 2.6 through 3.4, Mac OS X 10 through 10.5.1, FreeBSD 4.4 through 7.0, and DragonFlyBSD 1.0 through 1.10.1, allows remote attackers to guess sensitive values such as I...
CVE-2008-1147
A certain pseudo-random number generator PRNG algorithm that uses XOR and 2-bit random hops aka "Algorithm X2", as used in OpenBSD 2.6 through 3.4, Mac OS X 10 through 10.5.1, FreeBSD 4.4 through 7.0, and DragonFlyBSD 1.0 through 1.10.1, allows remote attackers to guess sensitive values such as I...
CVE-2008-1148
A certain pseudo-random number generator PRNG algorithm that uses ADD with 0 random hops aka "Algorithm A0", as used in OpenBSD 3.5 through 4.2 and NetBSD 1.6.2 through 4.0, allows remote attackers to guess sensitive values such as 1 DNS transaction IDs or 2 IP fragmentation IDs by observing a...
Design/Logic Flaw
A certain pseudo-random number generator PRNG algorithm that uses ADD with 0 random hops aka "Algorithm A0", as used in OpenBSD 3.5 through 4.2 and NetBSD 1.6.2 through 4.0, allows remote attackers to guess sensitive values such as 1 DNS transaction IDs or 2 IP fragmentation IDs by observing a...
CVE-2008-1147
CVE-2008-1147 describes a weakness in a PRNG that uses XOR and 2-bit random hops (Algorithm X2) used in OpenBSD 2.6–3.4, macOS 10–10.5.1, FreeBSD 4.4–7.0, and DragonFlyBSD 1.0–1.10.1. The vulnerability allows remote attackers to infer sensitive values such as IP fragmentation IDs by observing a s...
CVE-2008-1148
A certain pseudo-random number generator PRNG algorithm that uses ADD with 0 random hops aka "Algorithm A0", as used in OpenBSD 3.5 through 4.2 and NetBSD 1.6.2 through 4.0, allows remote attackers to guess sensitive values such as 1 DNS transaction IDs or 2 IP fragmentation IDs by observing a...
CVE-2008-1148: Undefined Security Weakness
A certain pseudo-random number generator PRNG algorithm that uses ADD with 0 random hops aka "Algorithm A0", as used in OpenBSD 3.5 through 4.2 and NetBSD 1.6.2 through 4.0, allows remote attackers to guess sensitive values such as 1 DNS transaction IDs or 2 IP fragmentation IDs by observing a...
CVE-2008-1147: Undefined Security Weakness
A certain pseudo-random number generator PRNG algorithm that uses XOR and 2-bit random hops aka "Algorithm X2", as used in OpenBSD 2.6 through 3.4, Mac OS X 10 through 10.5.1, FreeBSD 4.4 through 7.0, and DragonFlyBSD 1.0 through 1.10.1, allows remote attackers to guess sensitive values such as I...
Verified evasion in Snort
pre Dan Kaminsky gave a presentation at shmoocon and mentioned using ip fragmentation timers to evade intrusion detection systems. It's a pretty straightforward technique and easy to code up so we decided to look and see if Snort was vulnerable...
RoseAttackv2.txt
/ ROSE attack variation 2 chuck at lemure.net Discovered by: gandalf at digital.net code modified from large IGMP attack by: Kox by Coolio coolio at k-r4d.com Sends out small IP fragments totalling up to a large ICMP packet. Then repeatedly sends last IP Fragment forcing reassembly code to traver...
'Malicious-URL' Feature may be Circumvented Using IP Fragmentation
Title: NetScreen Security Alert 51929 Date: 25 November 2002 Impact: 'Malicious-URL' Feature may be Circumvented Using IP Fragmentation Affected Products: All firewall/VPN appliances and systems Affected Software Releases: ScreenOS 2.7.1, 2.8, 3.0, 3.1, 4.0 Max Risk: Low Summary: In response to t...
CVE-1999-1463
Windows NT 4.0 before SP3 is affected by CVE-1999-1463 via the TCP/IP stack. The issue arises when a remote attacker sends improperly fragmented IP packets without the first fragment, which are reassembled by the stack into a valid session, allowing bypass of firewall restrictions or causing a de...
IP Fragmentation Denial-of-Service Vulnerability in FireWall-1
Overview A large stream of IP traffic can monopolize the CPU of a Check Point FireWall-1 firewall, resulting in a denial-of-service condition. Description A denial-of-service vulnerability has been discovered in the FireWall-1 product from Check Point Software Technologies. Check Point has tested...
FW-1 IP Fragmentation Vulnerability
DISCLAIMER It was never my intent to identify a DoS attack on FW-1. I was attempting to research and understand how FW-1 handles IP Fragmentation. Everthing that follows is a result of that research. Full findings of my research can be found at http://www.enteract.com/lspitz/fwtable.html...
firewall-1.fragment.txt
SCLAIMER It was never my intent to identify a DoS attack on FW-1. I was attempting to research and understand how FW-1 handles IP Fragmentation. Everthing that follows is a result of that research. Full findings of my research can be found at http://www.enteract.com/lspitz/fwtable.html. On...
D-Link Dl-704 2.56 b5 - IP Fragment Denial of Service
D-Link Dl-704 2.56 b5 - IP Fragment Denial of Service // source: https://www.securityfocus.com/bid/3306/info The DLink Dl-704 is a DSL/Cable router and switch designed for home network use. A problem has been discovered in the Dl-704 router. Upon receiving a high amount of fragmented IP packets,...
CVE-1999-0258
CVE-1999-0258 is a Bonk variation of a teardrop IP fragmentation denial of service. Documents describe a remote network-exploitable DoS caused by a flaw in the TCP/IP fragmentation handling. No concrete affected products, versions, or fixes are explicitly stated in the provided sources; remediati...
CVE-1999-0257
CVE-1999-0257 corresponds to the Nestea variation of the teardrop IP fragmentation denial-of-service attack. The connected documents consistently describe a network DoS via IP fragmentation handling, without citing concrete affected products, versions, or a confirmed remediation patch within the ...