Bugtraq mailing list archives
Re: IPv4 fragmentation --> The Rose Attack
From: "Crist J. Clark" <cristjc () comcast net>
Date: Wed, 31 Mar 2004 15:42:33 -0800
On Wed, Mar 31, 2004 at 03:07:31PM -0500, stanislav shalunov wrote:
<gandalf () digital net> writes:While this discussion pertains to IPv4, IPv6 also allows fragmentation and I suspect IPv6 will also be affected by this attack.IPv6 does not have en-route fragmentation and, therefore, has no reassembly. IPv6 is not affected.
IPv6 does have end-station fragmentation, and therefore, it DOES have reassebly, see Section 4.5 of RFC2460. I do not see why an IPv6 implementation would not also potentially be affected. This is YANFA, Yet Another IP Fragmentation Attack. Teardrop, Ping O' Death, NewTear, Boink, yada-yada. Some have exploited bugs in reassembly code (over lapping frags, >65535-byte packets, etc.) and others, like this, are flat out resource exhaustion DoSes. The IP stack needs to be sane about how many datagrams it will try to reassemble at once. This attack points out that when considering that, you need to account for the fact a malicious attacker might eat reassembly resources much faster than his bandwidth would seem to indicate (two small packets can look like almost 65535). The other approach is for the reassembly algorithm has to be careful about how it allocates buffers for reassembly. -- Crist J. Clark | cjclark () alum mit edu | cjclark () jhu edu http://people.freebsd.org/~cjc/ | cjc () freebsd org
Current thread:
- Re: IPv4 fragmentation --> The Rose Attack Crist J. Clark (Mar 31)
- Re: IPv4 fragmentation --> The Rose Attack stanislav shalunov (Apr 01)
- <Possible follow-ups>
- Re: IPv4 fragmentation --> The Rose Attack Chris Brenton (Apr 01)
- Re: IPv4 fragmentation --> The Rose Attack Paul Starzetz (Apr 08)