Slashdot Mirror

← Back to Stories (view on slashdot.org)

TCP Vulnerability Published

Posted by ryuzaki0 on from the DOS-for-fun-and-profit dept.

Bob Slidell writes "According to Yahoo!, there is a critical flaw in TCP that affects everyone and everything. The article is scant on details and long on fear, hopefully someone will post more details on this." The advisory has more information, and is long on details but only moderate on fear.

3 of 676 comments (clear)

  1. Re:Implementation issue by LostCluster · · Score: 1, Redundant

    It means this isn't earth-shaking, but it likely means another security patch that Microsoft needs to issue for Windows... but this one other TCP stacks may have fallen for too.

  2. Re:I, for one... by prat393 · · Score: 1, Redundant

    In soviet russia, sequence numbers generate you!

  3. The exploit has already been demonstrated by CHICK543 · · Score: 1, Redundant

    The issue described in this advisory is the practicability of resetting an established TCP connection by sending suitable TCP packets with the RST (Reset) or SYN (Synchronise) flags set.


    The packets need to have source and destination IP addresses that match the established connection as well as the same source and destination TCP ports.


    The fact that TCP sessions can be reset by sending suitable RST and SYN packets is a design feature of TCP according to RFC 793, but a reset attack is only possible at all because the source IP address and TCP port can be forged or "spoofed".


    Although denial of service using crafted TCP packets is a well known weakness of TCP, until recently it was believed that a successful denial of service attack was not achievable in practice. The reason for this is that the receiving TCP implementation checks the sequence number of the RST or SYN packet, which is a 32 bit number, giving a probability of 1/232 of guessing the sequence number correctly (assuming a random distribution).


    The discoverer of the practicability of the RST attack was Paul A. Watson, who describes his research in his paper "Slipping In The Window: TCP Reset Attacks", presented at the CanSecWest 2004 conference. He noticed that the probability of guessing an acceptable sequence number is much higher than 1/232 because the receiving TCP implementation will accept any sequence number in a certain range (or "window") of the expected sequence number. The window makes TCP reset attacks practicable.