More TCP/IP protocol vulnerabilities

"SYN-flooding" involved sending SYN packets to an open TCP service on a remote host without engaging in the rest of the TCP connection-opening handshake. The target host would keep these "half-open" connections around for a while on the assumption that the rest of the handshake was being delayed; this would fill internal tables and make that service unavailable. The symptom on a host being attacked in this way was a large number of connections remaining in the SYN_RCVD state (as shown by netstat). TCP implementations were modified to reduce the timeouts for such half-open connections or to more aggressively recycle their resource slots with preference to connections whose handshaking finished.

The "teardrop" bug involved a carefully-constructed sequence of IP packet fragments which, when reassembled, would trigger bugs in many TCP/IP implementations that typically resulted in kernel crashes. IP packets may be up to 2^16 bytes in size, but most network protocols used to carry IP have packet sizes shorter than this, such as Ethernet which has a maximum packet size of 1500 bytes. Consequently the IP protocol has a mechanism for fragmenting a large packet into smaller ones which can be reassembled in sequence at the destination. Obviously this can be a bit tricky to implement, and one major class of implementations based on the BSD TCP/IP stack tended to be vulnerable to this.

Next ->


Steve VanDevender
Last modified: Wed Jul 28 22:43:18 PDT 2004