109 matches found
Design/Logic Flaw
A certain pseudo-random number generator PRNG algorithm that uses ADD with 0 random hops aka "Algorithm A0", as used in OpenBSD 3.5 through 4.2 and NetBSD 1.6.2 through 4.0, allows remote attackers to guess sensitive values such as 1 DNS transaction IDs or 2 IP fragmentation IDs by observing a...
CVE-2008-1147
CVE-2008-1147 describes a weakness in a PRNG that uses XOR and 2-bit random hops (Algorithm X2) used in OpenBSD 2.6–3.4, macOS 10–10.5.1, FreeBSD 4.4–7.0, and DragonFlyBSD 1.0–1.10.1. The vulnerability allows remote attackers to infer sensitive values such as IP fragmentation IDs by observing a s...
CVE-2008-1148
A certain pseudo-random number generator PRNG algorithm that uses ADD with 0 random hops aka "Algorithm A0", as used in OpenBSD 3.5 through 4.2 and NetBSD 1.6.2 through 4.0, allows remote attackers to guess sensitive values such as 1 DNS transaction IDs or 2 IP fragmentation IDs by observing a...
Verified evasion in Snort
pre Dan Kaminsky gave a presentation at shmoocon and mentioned using ip fragmentation timers to evade intrusion detection systems. It's a pretty straightforward technique and easy to code up so we decided to look and see if Snort was vulnerable...
RoseAttackv2.txt
/ ROSE attack variation 2 chuck at lemure.net Discovered by: gandalf at digital.net code modified from large IGMP attack by: Kox by Coolio coolio at k-r4d.com Sends out small IP fragments totalling up to a large ICMP packet. Then repeatedly sends last IP Fragment forcing reassembly code to traver...
'Malicious-URL' Feature may be Circumvented Using IP Fragmentation
Title: NetScreen Security Alert 51929 Date: 25 November 2002 Impact: 'Malicious-URL' Feature may be Circumvented Using IP Fragmentation Affected Products: All firewall/VPN appliances and systems Affected Software Releases: ScreenOS 2.7.1, 2.8, 3.0, 3.1, 4.0 Max Risk: Low Summary: In response to t...
CVE-1999-1463
Windows NT 4.0 before SP3 is affected by CVE-1999-1463 via the TCP/IP stack. The issue arises when a remote attacker sends improperly fragmented IP packets without the first fragment, which are reassembled by the stack into a valid session, allowing bypass of firewall restrictions or causing a de...
IP Fragmentation Denial-of-Service Vulnerability in FireWall-1
Overview A large stream of IP traffic can monopolize the CPU of a Check Point FireWall-1 firewall, resulting in a denial-of-service condition. Description A denial-of-service vulnerability has been discovered in the FireWall-1 product from Check Point Software Technologies. Check Point has tested...
FW-1 IP Fragmentation Vulnerability
DISCLAIMER It was never my intent to identify a DoS attack on FW-1. I was attempting to research and understand how FW-1 handles IP Fragmentation. Everthing that follows is a result of that research. Full findings of my research can be found at http://www.enteract.com/lspitz/fwtable.html...
firewall-1.fragment.txt
SCLAIMER It was never my intent to identify a DoS attack on FW-1. I was attempting to research and understand how FW-1 handles IP Fragmentation. Everthing that follows is a result of that research. Full findings of my research can be found at http://www.enteract.com/lspitz/fwtable.html. On...
D-Link Dl-704 2.56 b5 - IP Fragment Denial of Service
D-Link Dl-704 2.56 b5 - IP Fragment Denial of Service // source: https://www.securityfocus.com/bid/3306/info The DLink Dl-704 is a DSL/Cable router and switch designed for home network use. A problem has been discovered in the Dl-704 router. Upon receiving a high amount of fragmented IP packets,...
CVE-1999-0258
CVE-1999-0258 is a Bonk variation of a teardrop IP fragmentation denial of service. Documents describe a remote network-exploitable DoS caused by a flaw in the TCP/IP fragmentation handling. No concrete affected products, versions, or fixes are explicitly stated in the provided sources; remediati...
CVE-1999-0257
CVE-1999-0257 corresponds to the Nestea variation of the teardrop IP fragmentation denial-of-service attack. The connected documents consistently describe a network DoS via IP fragmentation handling, without citing concrete affected products, versions, or a confirmed remediation patch within the ...
CVE-1999-0258
Bonk variation of teardrop IP fragmentation denial of service...
CVE-1999-0431
Linux 2.2.3 and earlier allow a remote attacker to perform an IP fragmentation attack, causing a denial of service...
CVE-1999-0431
CVE-1999-0431 affects Linux kernels 2.2.3 and earlier, where a flaw in IP fragment handling lets a remote attacker perform an IP fragmentation attack to cause a denial of service. The Red Hat and CVE records consistently describe the issue as a remote DoS via IP fragmentation. Public details in t...
CVE-1999-0257
Nestea variation of teardrop IP fragmentation denial of service...
CVE-1999-0157
Cisco PIX firewall/CBAC is affected by CVE-1999-0157 due to an IP fragmentation handling issue that can lead to a denial of service. The available connected documents identify the affected product (Cisco PIX firewall with CBAC) and the impact (DoS), but do not provide explicit root-cause details,...
CVE-1999-0052
CVE-1999-0052 describes an IP fragmentation denial of service affecting FreeBSD, where a remote attacker can cause the system to crash. Available connected sources corroborate the issue as a fragmented-IP handling vulnerability in FreeBSD, with descriptions consistently noting a crash condition. ...