CVE-2006-1242

CVE-2006-1242 affects the Linux kernel (2.4.x and 2.6.x up to before 2.6.16). The ip_push_pending_frames function increments the IP ID when sending a RST after unsolicited TCP SYN-ACKs, enabling remote Idle-Scan (nmap -sI) bypassing certain protections. Affected versions: Linux 2.4.x and 2.6.x be...

CVE-2006-1242

The ippushpendingframes function in Linux 2.4.x and 2.6.x before 2.6.16 increments the IP ID field when sending a RST after receiving unsolicited TCP SYN-ACK packets, which allows remote attackers to conduct an Idle Scan nmap -sI attack, which bypasses intended protections against such attacks...

IP ID could allow to scan a masquerade network.

Hello, I was working on a new implementation of the IPID scann also known has idle scan in the nmap man page or pixie-scan as i call it During my test I think I discover a new way to use this type of scan : Synopsis ------------- Using the gateway of a masquerade network as a witness relay host f...

Новый вид сканирования - Pixie scan

Используется факт линейного изменения IP ID, что позволяет просканировать открытые порты даже за маскарирующим сервером используя пакет с внутреннего адреса и проверяя прирощение IP ID...