Copyright 2024 - CSIM - Asian Institute of Technology

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

-----BEGIN PGP SIGNED MESSAGE-----

=============================================================================
CERT* Advisory CA-97.28
Original issue date: Dec. 16, 1997
Last revised: --

Topic:  IP Denial-of-Service Attacks
- -----------------------------------------------------------------------------

The CERT Coordination Center has received reports of two attack tools
(Teardrop and Land) that are being used to exploit two vulnerabilities in the
TCP/IP protocol. Both tools enable a remote user to cause a denial of service.

The CERT/CC team recommends installing patches from your vendor. Until you are
able to do so, we urge you to use the workaround described in Section
III.B. to reduce the likelihood of a successful attack using Land. There is
no workaround for Teardrop.

We will update this advisory as we receive additional information.
Please check our advisory files regularly for updates that relate to your
site.

- -----------------------------------------------------------------------------

I. Description

     In recent weeks there has been discussion on public mailing lists about
     two denial-of-service attack tools, Teardrop and Land. These attack tools
     have similar effects on some systems (namely, causing the victim machine
     to crash), but the tools exploit different vulnerabilities.

     The CERT Coordination Center has received several reports of sites being
     attacked by either one or both of these tools. It is important to note
     that it may be necessary for a system administrator to apply separate
     patches, if they exist, for each attack tool.

     Topic 1 - Teardrop

     Some implementations of the TCP/IP IP fragmentation re-assembly code do
     not properly handle overlapping IP fragments. Teardrop is a widely
     available attack tool that exploits this vulnerability.

     Topic 2 - Land

     Some implementations of TCP/IP are vulnerable to packets that are crafted
     in a particular way (a SYN packet in which the source address and port
     are the same as the destination--i.e., spoofed). Land is a widely
     available attack tool that exploits this vulnerability.

II.  Impact

     Topic 1 - Teardrop

     Any remote user can crash a vulnerable machine.


     Topic 2 - Land

     Any remote user that can send spoofed packets to a host can crash or
     "hang" that host.


III. Solution

     CERT/CC urges you to immediately apply vendor patches if they are
     available. You may have to apply different patches for each attack tool.

     You may want to use the workaround for Land, so please review
     both Sections A and B below.

    A. Consult your vendor

       Appendix A contains information from vendors who provided input for
       this advisory. We will update the appendix as we receive more
       information. If you do not see your vendor's name, the CERT/CC did not
       hear from that vendor. Please contact your vendor directly.

       It is important to note that you may have to apply different
       patches for each attack tool.

    B. Apply the following workaround (Land only)

       A workaround for the Land attack tool is to block IP-spoofed packets.
       This workaround does not apply to the Teardrop attack tool because the
       Teardrop attack does not rely on IP-spoofed packets.

       Attacks like those of the Land tool rely on the use of forged packets,
       that is, packets where the attacker deliberately falsifies the origin
       address. With the current IP protocol technology, it is impossible to
       eliminate IP-spoofed packets. However, you can reduce the likelihood of
       your site's networks being used to initiate forged packets by filtering
       outgoing packets that have a source address different from that of your
       internal network.

       Currently, the best method to reduce the number of IP-spoofed packets
       exiting your network is to install filtering on your routers that
       requires packets leaving your network to have a source address from
       your internal network. This type of filter prevents a source IP
       spoofing attack from your site by filtering all outgoing packets that
       contain a source address from a different network.

       A detailed description of this type of filtering is available in the
       Internet Draft "Network Ingress Filtering: Defeating Denial of Service
       Attacks which employ IP Source Address Spoofing" by Paul Ferguson of
       Cisco Systems, Inc. and Daniel Senie of Blazenet, Inc. Note that
       although this document is labeled as an IETF "working draft," the
       content is complete and it is being proposed as an Informational RFC.
       We recommend it to both Internet Service Providers and sites that
       manage their own routers.

       The document is currently available at

http://ds.internic.net/internet-drafts/draft-ferguson-ingress-filtering-03.txt


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Appendix A - Vendor Information

Below is a list of the vendors who have provided information for this
advisory. We will update this appendix as we receive additional information.
If you do not see your vendor's name, the CERT/CC did not hear from that
vendor. Please contact the vendor directly.

Cisco Systems
=============

Topic 1 - Teardrop

No feedback.

Topic 2 - Land

IOS/7000 software, Catalyst 5xxx and 29xx LAN switches, BPX and IGX WAN
switches and AXIS shelf appear to be vulnerable.
PIX firewall and Centri firewall are not vulnerable.

For more information reference URL:
http://www.cisco.com/warp/public/770/land-pub.shtml


Digital Equipment Corporation
=============================

Topic 1 - Teardrop

No feedback.

Topic 2 - Land

ULTRIX is not vulnerable.


The FreeBSD Project
===================

Topic 1 - Teardrop

CSRG 4.4 is not vulnerable.

Topic 2 - Land

No feedback.


Hewlett-Packard Corporation
===========================

Topic 1 - Teardrop

HP-UX versions 9.04-10.20 are not vulnerable.

Topic 2 - Land

No feedback.


IBM Corporation
===============

Topic 1 - Teardrop

AIX is not vulnerable.

Topic 2 - Land

AIX is not vulnerable.


Microsoft Corporation
=====================

Topic 1 - Teardrop

Windows NT 4.0 with SP 3 and post SP 3 fixes applied and Windows 95
with the appropriate patch are not vulnerable.
Patch information is available at URL:
ftp://ftp.microsoft.com/bussys/winnt/kb/Q154/1/74.TXT

Topic 2 - Land

Windows NT 4.0 with the appropriate patch is not vulnerable.
Patch information is available at URL:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
hotfixes-postSP3/land-fix/Q165005.txt

Windows 95 without the WinSock 2.0 Update is not vulnerable.
Patch information is available at URL:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
hotfixes-postSP3/land-fix/Q177539.TXT


NCR Corporation
===============

Topic 1 - Teardrop

NCR TCP/IP implementation is not vulnerable.

Topic 2 - Land

No feedback.


The NetBSD Project
==================

Topic 1 - Teardrop

Versions 1.2 and above are not vulnerable.

Topic 2 - Land

No feedback.


Red Hat Software
================

Topic 1 - Teardrop

Linux is not vulnerable.

Topic 2 - Land

Linux is not vulnerable.

- ---------------------------------------------------------------------------

The CERT Coordination Center thanks Paul Ferguson and Daniel Senie for
providing information on network ingress filtering.

- ----------------------------------------------------------------------------

If you believe that your system has been compromised, contact the CERT
Coordination Center or your representative in the Forum of Incident Response
and Security Teams (see http://www.first.org/team-info/).


CERT/CC Contact Information
- ----------------------------
Email    This email address is being protected from spambots. You need JavaScript enabled to view it.

Phone    +1 412-268-7090 (24-hour hotline)
                CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4)
                and are on call for emergencies during other hours.

Fax      +1 412-268-6989

Postal address
         CERT Coordination Center
         Software Engineering Institute
         Carnegie Mellon University
         Pittsburgh PA 15213-3890
         USA

Using encryption
   We strongly urge you to encrypt sensitive information sent by email. We
   can  support a shared DES key or PGP. Contact the CERT/CC for more
   information.

   Location of CERT PGP key
         ftp://ftp.cert.org/pub/CERT_PGP.key

Getting security information
   CERT publications and other security information are available from
        http://www.cert.org/
        ftp://ftp.cert.org/pub/

   CERT advisories and bulletins are also posted on the USENET newsgroup
        comp.security.announce

   To be added to our mailing list for advisories and bulletins, send
   email to
        This email address is being protected from spambots. You need JavaScript enabled to view it.
   In the subject line, type
	SUBSCRIBE  your-email-address

- ---------------------------------------------------------------------------

Copyright 1997 Carnegie Mellon University. Conditions for use, disclaimers,
and sponsorship information can be found in
http://www.cert.org/legal_stuff.html and ftp://ftp.cert.org/pub/legal_stuff .
If you do not have FTP or web access, send mail to This email address is being protected from spambots. You need JavaScript enabled to view it. with
"copyright" in the subject line.

*CERT is registered in the U.S. Patent and Trademark Office.

- ---------------------------------------------------------------------------

This file: ftp://ftp.cert.org/pub/cert_advisories/CA-97.28.Teardrop_Land
           http://www.cert.org
               click on "CERT Advisories"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Revision history

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNJaZMXVP+x0t4w7BAQETVwP/bJs/07PqnM5VxfNqj+Iw+eGORosq6Xyc
JQ7o69ePzo20pusBIhlb2DjrLAeEwlqzBwBV8W1Y/lujaWWLTsotPasMB7kK+dJp
sOBMAFwMb/RjawVnizs+F0V1JvqbQbIfUquaqursDUG7DRVDT9O8d7nzf4CS7n+M
VFgx9ryzcHc=
=hOK4
-----END PGP SIGNATURE-----


Powered by: MHonArc

Login Form

Search

School of Engineering and technologies     Asian Institute of Technology