Re: Cisco PIX bug, discussions (lenghty)

["Ryan Russell" <Ryan.Russell () sybase com>]

Thanks, I hadn't read that one before.

If I'm interpreting correctly, it basically recommends that filtering
routers do some minimum frag reassembly, taking care to
handle overlapping frags carefully, so you have enough
data to see the transport headers.

Interestingly enough... it looks like the authors saw the issues
for most, if not all, the frag attacks that we're seeing used now....
in 1995.

                         Ryan






Just in case everyone has forgotten:

RFC 1859: Security Considerations for IP Fragment Filtering
ftp://ftp.isi.edu/in-notes/rfc1858.txt

Aleph One / aleph1 () dfw net
http://underground.org/
KeyID 1024/948FD6B5
Fingerprint EE C9 E8 AA CB AF 09 61  8C 39 EA 47 A8 6A B8 01