oss-sec mailing list archives
CVE-2016-5389: linux kernel - challange ack information leak.
From: Wade Mealing <wmealing () redhat com>
Date: Tue, 12 Jul 2016 14:33:54 +1000
Gday, Red Hat Product Security has been made aware of an important issue in the Linux kernel's implementation of challenge ACKS as specified in RFC 5961. An attacker which knows a connections client IP, server IP and server port can abuse the challenge ACK mechanism to determine the accuracy of a normally 'blind' attack on the client or server. Successful exploitation of this flaw could allow a remote attacker to inject or control a TCP stream contents in a connection between a Linux device and its connected client/server. * This does NOT mean that cryptographic information is exposed. * This is not a Man in the Middle (MITM) attack. This was reported to Red Hat by Yue Cao, part of the Cyber Security Group in the University of California Thanks, Wade Mealing Red Hat Product Security Team Red Hat Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1354708 Patch: https://www.mail-archive.com/netdev () vger kernel org/msg118677.html
Current thread:
- CVE-2016-5389: linux kernel - challange ack information leak. Wade Mealing (Jul 11)
- Re: CVE-2016-5389: linux kernel - challange ack information leak. Wade Mealing (Jul 12)
- Re: CVE-2016-5696: linux kernel - challange ack information leak. Sona Sarmadi (Aug 14)
- Re: CVE-2016-5696: linux kernel - challange ack information leak. Greg KH (Aug 14)
- RE: CVE-2016-5696: linux kernel - challange ack information leak. Sona Sarmadi (Aug 14)
- Re: CVE-2016-5696: linux kernel - challange ack information leak. Greg KH (Aug 15)
- Re: CVE-2016-5696: linux kernel - challange ack information leak. Sona Sarmadi (Aug 16)
- Re: CVE-2016-5696: linux kernel - challange ack information leak. Greg KH (Aug 16)
- RE: CVE-2016-5696: linux kernel - challange ack information leak. Sona Sarmadi (Aug 17)
- Re: CVE-2016-5696: linux kernel - challange ack information leak. Greg KH (Aug 17)
- Re: CVE-2016-5696: linux kernel - challange ack information leak. Gsunde Orangen (Aug 17)
- Re: CVE-2016-5696: linux kernel - challange ack information leak. Greg KH (Aug 14)