Bugtraq mailing list archives
Re: IPv4 fragmentation --> The Rose Attack
From: Darren Reed <avalon () caligula anu edu au>
Date: Sat, 10 Apr 2004 23:23:52 +1000 (Australia/ACT)
In some mail from gandalf () digital net, sie said:
On 4/9/04 12:56 PM, "Darren Reed" <avalon () caligula anu edu au> wrote:In some mail from gandalf () digital net, sie said:From my experience in the real world, specifically with Windows 98 (and I suspect ME) I would say that yes we should care. You would probably be frightened at the number of people still running Windows 9* and ME.In this particular case, whether someone is running Windows ME/9* is irrelevant to me - it's a local attack against them that isn't likely to affect me.I work at many other places than on my own personal computers. I would like to know if attacks might affect any number of computers. I am a computer professional.
And if so, surely any place where you see "Windows 9*/ME" should bring a "you need to start planning on upgrading/replacing these with 2K/XP, if you haven't already." styled response.
Or program with queues that drop packets in a FIFO fashion that have enough memory that an attack will still allow fragmented packets to be serviced. You can (at least) make it harder to DoS a machine.
If the time an entry stays in the queue is less than the time required for reassembly to occur then even a FIFO will not suffice as an adequate algorithmic countermeasure. There are solutions to this too, but this is just to say that it's more complex than "throw this data structure in to fix." Darren
Current thread:
- Re: IPv4 fragmentation --> The Rose Attack Ventsislav Genchev (Apr 07)
- Re: IPv4 fragmentation --> The Rose Attack Darren Reed (Apr 08)
- Re: IPv4 fragmentation --> The Rose Attack gandalf (Apr 09)
- Re: IPv4 fragmentation --> The Rose Attack Darren Reed (Apr 09)
- Re: IPv4 fragmentation --> The Rose Attack gandalf (Apr 12)
- Re: IPv4 fragmentation --> The Rose Attack Darren Reed (Apr 10)
- Re: IPv4 fragmentation --> The Rose Attack gandalf (Apr 12)
- Re: IPv4 fragmentation --> The Rose Attack gandalf (Apr 09)
- Re: IPv4 fragmentation --> The Rose Attack Darren Reed (Apr 08)