F5 BIG-IP - F5 Path MTU Discovery vulnerability CVE-2015-7759

The remote host is missing a security patch. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:f5:big-ip"; if description...

F5 Networks BIG-IP : F5 Path MTU Discovery vulnerability (K22843911)

BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 12.0.0 before HF1, when the TCP profile for a virtual server is configured with Congestion Metrics Cache enabled, allow remote attackers to cause a denial of service Traffic Management Microkernel TMM restart via crafted ICMP...

SOL22843911 - F5 Path MTU Discovery vulnerability CVE-2015-7759

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

F5 Networks BIG-IP : Path MTU discovery vulnerability (K15792)

Multiple TCP/IP and ICMP implementations, when using Path MTU PMTU discovery PMTUD, allow remote attackers to cause a denial of service network throughput reduction for TCP connections via forged ICMP 'Fragmentation Needed and Don't Fragment was Set' packets with a low next-hop MTU value, aka the...

Nmap NSE net: path-mtu

Performs simple Path MTU Discovery to target hosts. TCP or UDP packets are sent to the host with the DF don't fragment bit set and with varying amounts of data. If an ICMP Fragmentation Needed is received, or no reply is received after retransmissions, the amount of data is lowered and another...

Nmap NSE net: path-mtu

This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

path-mtu NSE Script

Performs simple Path MTU Discovery to target hosts. TCP or UDP packets are sent to the host with the DF don't fragment bit set and with varying amounts of data. If an ICMP Fragmentation Needed is received, or no reply is received after retransmissions, the amount of data is lowered and another...

[Full-disclosure] ICMP-based blind performance-degrading attack

Folks, Another trivial ICMP-based attack. We'll use the tool icmp-mtu, available at http://www.gont.com.ar/tools/icmp-attacks We'll perform the blind performance-degrading attack described in http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html as the "Attack against the Path-MTU Discovery...

HPSBTU01210 SSRT4743, SSRT4884 rev.0 - HP Tru64 UNIX TCP/IP remote Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 HP SECURITY BULLETIN HPSBTU01210 REVISION: 0 SSRT4743, SSRT4884 rev.0 - HP Tru64 UNIX TCP/IP remote Denial of Service DoS NOTICE: There are no restrictions for distribution of this Security Bulletin provided that it remains complete and intact. The...

CVE-2004-1060

CVE-2004-1060 enables a denial-of-service via forged ICMP PMTU-discovery packets that degrade TCP throughput. Connected advisories show affected BIG-IP products and data-plane components; vulnerable versions include BIG-IP LTM/AAM/AFM/etc. for 10.x–11.x releases (e.g., 11.0.0–11.6.0, 10.0.0–10.2....

TCP/IP implementations do not adequately validate ICMP error messages

Overview Multiple TCP/IP implementations do not adequately validate ICMP error messages. A remote attacker could cause TCP connections to drop or be degraded using spoofed ICMP error messages. Description A number of widely accepted Internet standards describe different aspects of the relationshi...

CVE-2005-0068

CVE-2005-0068 is attack-based and tied to ICMP handling flaws (forgeable ICMP errors affecting TCP/Path MTU) with related CVEs (2004-0790/0791/1060). Connected documents provide concrete details: ICMP authentication gaps enable denial-of-service via spoofed messages (Destination Unreachable, Sour...

CVE-2005-0065

The original design of TCP does not check that the TCP sequence number in an ICMP error message is within the range of sequence numbers for data that has been sent but not acknowledged aka "TCP sequence number checking", which makes it easier for attackers to forge ICMP error messages for specifi...

CVE-2005-0067

Technical details for CVE-2005-0067 (affected software/versions, root cause, impact, and fixes) are not publicly available in the provided Connected documents. Monitor for updates.

CVE-2004-1060

Multiple TCP/IP and ICMP implementations, when using Path MTU PMTU discovery PMTUD, allow remote attackers to cause a denial of service network throughput reduction for TCP connections via forged ICMP "Fragmentation Needed and Don't Fragment was Set" packets with a low next-hop MTU value, aka the...

CVE-2001-0323

The ICMP path MTU PMTU discovery feature in various UNIX systems allows remote attackers to cause a denial of service by spoofing "ICMP Fragmentation needed but Don't Fragment DF set" packets between two target hosts, which could cause one host to lower its MTU when transmitting to the other host...

CVE-2001-0323

The ICMP path MTU PMTU discovery feature in various UNIX systems allows remote attackers to cause a denial of service by spoofing "ICMP Fragmentation needed but Don't Fragment DF set" packets between two target hosts, which could cause one host to lower its MTU when transmitting to the other host...

CVE-2001-0323

The CVE-2001-0323 entry describes a denial-of-service risk in the ICMP path MTU (PMTU) discovery feature used by various UNIX systems. The underlying issue is that remote attackers can spoof ICMP messages of type “Fragmentation needed but Don’t Fragment (DF) set” between two hosts, potentially ca...

Re: ICMP fragmentation required but DF set problems.

This is a valid method, and known, to slow down a link between two hosts. In my paper "ICMP Usage In Scanning" currently version 2.5 Appendix B: ICMP "Fragmentation Needed but the Don't Fragment Bit was set" and the Path MTU Discovery Process Page 132, I have outlined what should be done accordin...

ICMP fragmentation required but DF set problems.

Hi all, The problem I'm exposing is quite obvious, but unfortunatelly can be used in a very simple way by script kiddies. SYNOPSIS It's possible to slowdown a lot connections between two arbirary hosts but at least one with the PMTU discovery enabled using some spoofed TCP/IP packet. Maybe you ca...