Re: Linux zero IP ID vulnerability?

[GomoR <bugtraq () gomor org>]

On Wed, Mar 15, 2006 at 10:26:00AM +0100, Marco Ivaldi wrote:
[..]
> Not sure i fully understand your comments... Anyway, here's an host
> showing the flawed behaviour (Gentoo Linux 2.6.14-gentoo-r5 + grsec):

Well, it may be related to GR security. 

SinFP[1] exploits a difference in IP ID generation to detect
(to some extent) the use of GR security inside a Linux kernel. 

In fact, last time I checked, there was an option in GRsec
configuration to alter IP ID generation behaviour. You can try
to play with this. 

[1] http://www.gomor.org/cgi-bin/index.pl?mode=view;page=net_sinfp 

--
^  ___  ___             http://www.GomoR.org/          <-+
| / __ |__/          Systems & Security Engineer         |
| \__/ |  \     ---[ zsh$ alias psed='perl -pe ' ]---    |
+-->  Net::Packet <=> http://search.cpan.org/~gomor/  <--+