CVE-2005-3810

ipconntrackprotoicmp.c in ctnetlink in Linux kernel 2.6.14 up to 2.6.14.3 allows attackers to cause a denial of service kernel oops via a message without ICMP ID ICMPID information, which leads to a null dereference...

CVE-2005-3810

ipconntrackprotoicmp.c in ctnetlink in Linux kernel 2.6.14 up to 2.6.14.3 allows attackers to cause a denial of service kernel oops via a message without ICMP ID ICMPID information, which leads to a null dereference...

CVE-2005-3810

ipconntrackprotoicmp.c in ctnetlink in Linux kernel 2.6.14 up to 2.6.14.3 allows attackers to cause a denial of service kernel oops via a message without ICMP ID ICMPID information, which leads to a null dereference...

p-smash DoS (ICMP 9 flood)

It was possible to crash the remote machine by flooding it with ICMP type 9 packets. SPDX-FileCopyrightText: 2002 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only According ...

scan for LaBrea tarpitted hosts

This script performs a labrea tarpit scan, by sending a bogus ACK and ACK-windowprobe to a potential host. It also sends a TCP SYN to test for non-persisting labrea machines. SPDX-FileCopyrightText: 2001 by John Lampe Some text descriptions might be excerpted from a referenced sources, and are...

'jolt2' DoS Vulnerability - Active Check

The machine or a gateway on the network path crashed when flooded with incorrectly fragmented packets. This is known as the SPDX-FileCopyrightText: 2003 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Linux SCTP ICMP Packet Handling Null Dereference Remote DoS

Linux kernels older than version 2.6.13 contain a bug that may allow an attacker to cause a NULL pointer dereference by sending malformed ICMP packets, thus resulting in a kernel panic. This flaw is present only if SCTP support is enabled on the remote host. An attacker can use this to make this...

ICMP and TCP timestamp attacks to reset TCP connections

By using different ICMP packet types and TCP timestamps values it's possible to cause TCP connection resets or performance decrease...

ICMP-based blind connection-reset attack

Folks, Here's the packet trace and the explanation of an ICMP-based blind connection-reset attack. In our sample scenario, a web-client 10.0.0.1, TCP port 3270 is downloading a file from a web-server 192.168.0.1, TCP port 80. If the TCP/IP implementations of both end-points are vulnerable,you can...

[Full-disclosure] ICMP attacks against TCP: Conclusions

Folks, My posts to this list have tried to show how easy it is to perform ICMP attacks against TCP. The attacks are blind, so the attacker does not need to be a "man in the middle" to perform then. The typical number of packets required to perform any of these attacks is about 16000 in many cases...

[Full-disclosure] ICMP-based blind performance-degrading attack

Folks, Another trivial ICMP-based attack. We'll use the tool icmp-mtu, available at http://www.gont.com.ar/tools/icmp-attacks We'll perform the blind performance-degrading attack described in http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html as the "Attack against the Path-MTU Discovery...

[SA16126] Blue Coat Products ICMP Message Handling Denial of Service

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

[Full-disclosure] Trivial BGP attacks (ICMP-based blind throughput-reduction attack)

Folks, It seems worthless to try to explain over and over again how trivial it is to perform ICMP-based attacks against TCP. So I have posted on my web site http://www.gont.com.ar/tools/icmp-attacks the same tools that vendors were supposed to use to audit their systems, and test their patches...

HPSBTU01210 SSRT4743, SSRT4884 rev.0 - HP Tru64 UNIX TCP/IP remote Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 HP SECURITY BULLETIN HPSBTU01210 REVISION: 0 SSRT4743, SSRT4884 rev.0 - HP Tru64 UNIX TCP/IP remote Denial of Service DoS NOTICE: There are no restrictions for distribution of this Security Bulletin provided that it remains complete and intact. The...

[SA15761] Nortel Networks Products ICMP Handling Vulnerabilities

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

[Full-disclosure] ICMP Security Vulnerabilities - NEW (cough)

I know this is now even older news than it was when the recent flurry of discussion started last week, but I'm just getting around to sharing a bit of additional information on the subject. Regarding those three 3 "vulnerabilities" discussed by Fernando can't recall his last name, no offense mean...

ICMP vulnerabilities

Much more information on the ICMP vulnerabilities that allow you to blindly tear down TCP sessions. http://kerneltrap.org/node/5382 Please note these are not man-in-the-middle attacks. You can do them blind. Totally blind. You do not need to know any information. There are three attacks outlined...

Feature: OpenBSD Hackathon 2005, Part III

One new attendee of this year's OpenBSD hackathon was Fernando Gont, a diverse individual from Argentina whose current job titles include teacher, technical writer, system administrator and network researcher. His presence at the hackathon was the result of an internet-draft he wrote about some...

CVE-2005-0039

Certain configurations of IPsec, when using Encapsulating Security Payload ESP in tunnel mode, integrity protection at a higher layer, or Authentication Header AH, allow remote attackers to decrypt IPSec communications by modifying the outer packet in ways that cause plaintext data from the inner...

CVE-2005-0039

CVE-2005-0039 describes vulnerabilities in IPsec configurations where using ESP in tunnel mode (with CBC mode) or AH without proper integrity protections allows an attacker to modify the outer packet and cause the inner, encrypted data to be exposed in plaintext via ICMP messages. The attacks inc...