Full Disclosure mailing list archives
RE: Decompression
From: "Curt Purdy" <purdy () tecman com>
Date: Tue, 27 Apr 2004 15:20:25 -0500
D B wrote:
I recently played with a png decompression bomb and my mind works wierd. I was wondering if someone who knows about tcp could tell me if it was possible to create this for a tcp packet.
<snip> TCP packets are not compressed on their own, so there is no "uncompressed size" info in the packets themselves as there are in the decompression bombs. The closest thing that would be similar is either the "windows size" field in tcp and the "total length" in ip. As they are both only 16 bits this would not give you much to work with. My gut feeling is that messing with these fields would only cause the network device to fragment the packet which would fail since there would be no bits beyond the true length to fragment. Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA Information Security Engineer DP Solutions ---------------------------------------- If you spend more on coffee than on IT security, you will be hacked. What's more, you deserve to be hacked. -- White House cybersecurity adviser Richard Clarke _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Decompression D B (Apr 27)
- RE: Decompression Curt Purdy (Apr 27)