Re: Windows IP Fragment Reassembly Vulnerability

[mikael.olsson () ENTERNET SE (Mikael Olsson)]

Masial wrote:
> Does anyone have info about this particular issue? I would be interested in
> seeing what are those 'malformed' packets look like, and as usual, microsoft
> dosent give any technical details about the vunlerability. Trust us blindly!

I saw something on this just a while ago, but since I'm catching up
with two weeks of not reading my mailing lists (10+ of them) I cannot
remember for the life of me where I saw it, could be bugtraq,
firewalls () lists gnac net or firewall-wizards () nfr net

Anyhow, from what I could gain, it was simply done by sending LOTS
of fragments (a couple of hundred) with the same fragment offset.
Any SPF worth its name ought to be able to protect you from it.
OTOH, any NT based proxy without its own fragment handler would
choke on them and DoS your entire connection. :-P

/Mike

--
Mikael Olsson, EnterNet Sweden AB, Box 393, SE-891 28 ÖRNSKÖLDSVIK
Phone: +46-(0)660-105 50           Fax: +46-(0)660-122 50
Mobile: +46-(0)70-66 77 636
WWW: http://www.enternet.se        E-mail: mikael.olsson () enternet se