Overview
Various vendors' TCP/IP implementations handle packets containing unusual flag combinations in different ways, which may lead to a violation of implicit or explicit security policies.
Description
Background on TCP/IP Connection Semantics To establish a TCP connection, a client and server must participate in a three-way handshake (as outlined in RFC793 - "Transmission Control Protocol"): |
Impact
The impact of this vulnerability is that an attacker may be able to establish connections with hosts behind firewalls in violation of implied security policies. As a result, an attacker can send data to hosts and services that he ordinarily cannot reach. An intruder could also leverage this flaw to exploit a vulnerability in passive software listening promiscuously on the inside of the firewall (e.g., vulnerability in tcpdump or some similar vulnerability). Note that the specific kinds of packets that may bypass a firewall are highly dependent on the implementation of the firewall. |
Solution
Apply a vendor patch. If a vendor patch is not available for your TCP implementation (and even if one is), you may wish to:
|
Vendor Information
The SCO Group (SCO Linux) Affected
Notified: October 24, 2002 Updated: May 01, 2003
Statement Date: April 30, 2003
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
Please see ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-019.0.txt.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Apple Computer, Inc. Not Affected
Notified: October 24, 2002 Updated: October 28, 2002
Statement Date: October 23, 2002
Status
Not Affected
Vendor Statement
The built-in firewall on Mac OS X and Mac OS X Server does not contain the vulnerabilty described in this report. Customers who have installed other firewall products should check with their third-party vendor for information.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Check Point Not Affected
Notified: October 24, 2002 Updated: October 25, 2002
Statement Date: October 24, 2002
Status
Not Affected
Vendor Statement
Check Point VPN-1/FireWall-1 products are engineered to provide the highest levels of security. VPN-1/FireWall-1 will automatically drop any invalid packet flag combinations including, but not limited to, those described in CERT VU# 464113. In addition, the Check Point SmartDefense product will provide additional logging and alerting if this type of attack is attempted.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Clavister Not Affected
Updated: April 01, 2003
Statement Date: March 21, 2003
Status
Not Affected
Vendor Statement
Clavister Firewall: Not vulnerable.
Clavister Firewall only allows plain SYN packets to create new states, and, as such, also protects hosts behind it.
In addition, thorough packet scrubbing is performed. The default settings for packets where the SYN flag is set are:
SYN+URG: Drop and log the packet
SYN+RST: Drop and log the packet
SYN+FIN: Drop and log the packet
SYN+PSH: Strip the PSH flag and log
Although SYN+PSH is very uncommon, some TCP stacks have been observed to use them. Early versions of MacTCP is one such stack.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Cray Inc. Not Affected
Notified: October 24, 2002 Updated: October 30, 2002
Statement Date: October 30, 2002
Status
Not Affected
Vendor Statement
Cray, Inc. is not vulnerable as we provide no software that performs this type of function.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Finjan Software Not Affected
Updated: October 25, 2002
Statement Date: October 24, 2002
Status
Not Affected
Vendor Statement
This issue isn't relevant to any of our products.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Foundry Networks Inc. Not Affected
Updated: April 01, 2003
Statement Date: March 27, 2003
Status
Not Affected
Vendor Statement
Foundry Networks does not produce stateful or packet filtering firewalls, but do support high speed packet filtering ACLs on its products. An ACL with the "established" operator turned on will filter on all TCP packets with the ACK (Acknowledgment) or RST (Reset) bits set to "1" (on) in the control filed of the TCP packet header. Current versions of shipping software will not permit unexpected combinations of SYN flags.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Fujitsu Not Affected
Notified: October 24, 2002 Updated: December 03, 2002
Statement Date: December 03, 2002
Status
Not Affected
Vendor Statement
Fujitsu's UXP/V OS is not vulnerable, because the relevant function is not supported under UXP/V.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Funk Software Not Affected
Updated: October 25, 2002
Statement Date: October 24, 2002
Status
Not Affected
Vendor Statement
While we are a vendor of a variety of products that involved network security, none of the products currently include firewall functionality that would be susceptible to the type of attack described below. We will keep this notification on file to ensure that any new products we might develop in the future are not susceptible to this attack.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Hewlett-Packard Company Not Affected
Notified: October 24, 2002 Updated: May 10, 2005
Statement Date: March 17, 2003
Status
Not Affected
Vendor Statement
SOURCE:
Hewlett-Packard Company
HP Services
Software Security Response Team
x-ref:SSRT2391
As further information becomes available HP will provide notice of the availability of any necessary patches through standard security bulletin announcements and be available from your normal HP Services support channel.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
IBM Corporation Not Affected
Notified: October 24, 2002 Updated: April 01, 2003
Statement Date: April 01, 2003
Status
Not Affected
Vendor Statement
The IBM AIX operating system is not vulnerable to the issues discussed in CERT Vulnerability Note VU#464113.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Ingrian Networks, Inc. Not Affected
Updated: March 18, 2003
Statement Date: March 17, 2003
Status
Not Affected
Vendor Statement
Ingrian Networks products are application-level proxies. The type of attack detailed in VU#464113 cannot be used to bypass their security.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Lotus Software Not Affected
Notified: October 24, 2002 Updated: March 14, 2003
Statement Date: March 13, 2003
Status
Not Affected
Vendor Statement
Lotus does not ship firewalls or packet filters, so there is no vulnerability due to TCP/IP connection open semantics.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Microsoft Corporation Not Affected
Notified: October 24, 2002 Updated: October 29, 2002
Statement Date: October 28, 2002
Status
Not Affected
Vendor Statement
Microsoft has thoroughly investigated this issue, and found that Microsoft's ISA Server firewall product is not affected by the scenario described in this report.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
NetScreen Not Affected
Updated: March 14, 2003
Statement Date: March 13, 2003
Status
Not Affected
Vendor Statement
NetScreen is not vulnerable to this issue.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
OpenBSD Not Affected
Notified: October 24, 2002 Updated: March 14, 2003
Statement Date: October 25, 2002
Status
Not Affected
Vendor Statement
The stateful packet filter (pf) that ships with OpenBSD 3.0 and later is not vulnerable to the attacks described.
pf uses real stateful TCP filtering and keeps track of established connections using a state table. It doesn't use any TCP flags to associate a packet with an established connection, instead it uses source and destination addresses and ports to find matching state entries (and verifies sequence numbers against narrow windows).
Filter rules specify which packets create state table entries, and the required TCP flags can be specified freely. It's possible to create state only for plain SYN packets or allow any combination of other TCP flags to do so.
In no case any packet with any combination of TCP flags can bypass the policy defined in the rule set (due to the packet filter wrongly assuming it is part of an established connection), as only explicit rules can create state tables entries.
To prevent SYN+RST packets from creating state, the option 'flags S/SAR' can be used (meaning 'SYN must be set, ACK and RST must not be set'). But even the common 'flags S/SA' will only create state when the remaining rule matches, allowing SYN+RST packets to establish only connections which are already allowed for plain SYNs.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Sun Microsystems, Inc. Not Affected
Notified: October 24, 2002 Updated: November 11, 2004
Status
Not Affected
Vendor Statement
+ Solaris is not vulnerable to this issue.
+ The SunScreen Firewall products only pass packets with the SYN bit set to a host that it has been configured to allow a connection to. Setting extra bits in a packet will not change this behaviour. In addition, the SunScreen TCP state engine will check that the following conform to RFC 793 before passing them:
* Packets in the three-way handshake.
* Packets with FIN bit set.
* Packets with RST bit set.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Trend Micro Not Affected
Notified: October 24, 2002 Updated: October 29, 2002
Statement Date: October 28, 2002
Status
Not Affected
Vendor Statement
TrendMicro has been aware for some time of the potential problems that this TCP-Flag combination issue contains. TrendMicro has two products which make use of the network-layer, where these flags are used to identify the current session status. These products are GateLock <http://www.gatelockglobal.com> and PC-cillin <http://www.pccillin.com>. Neither product is affected.
PC-cillin is an antivirus and antihacker security solution for computers and PDAs. It includes a personal firewall. This firewall does not pass through undefined SYN,FIN combination packets to the protected local services/ports.
TrendMicro GateLock is an all-in-one, plug-and-play Internet appliance designed for home and SOHO networks that uses a broadband connection. This appliance includes a stateful inspection firewall which does not allow the establishment of a session to the protected hosts in case of a SYN,FIN combination packet.
All other TrendMicro gateway products are categorized as application-level firewalls. These products running in the application-layer. The underlaying OS is responsible for the three-way handshake.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Xerox Corporation Not Affected
Notified: October 24, 2002 Updated: May 30, 2003
Statement Date: December 10, 2002
Status
Not Affected
Vendor Statement
A response to this vulnerability is available from our web site:
http://www.xerox.com/security.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
3Com Unknown
Notified: October 24, 2002 Updated: October 25, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
AT&T Unknown
Notified: October 24, 2002 Updated: October 25, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Alcatel Unknown
Notified: October 24, 2002 Updated: October 24, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Avaya Unknown
Notified: October 24, 2002 Updated: October 25, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Berkeley Software Design, Inc. Unknown
Notified: October 24, 2002 Updated: October 25, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Cisco Systems, Inc. Unknown
Notified: October 24, 2002 Updated: July 28, 2004
Statement Date: January 22, 2004
Status
Unknown
Vendor Statement
A new feature has been added to Cisco IOS starting from the IOS release 12.3(4)T. This feature provides a flexible mechanism for filtering on TCP flags. The new syntax can be found at the following URL:
http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a00801d344e.html
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Cistron Unknown
Notified: October 24, 2002 Updated: October 31, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Command Software Unknown
Notified: October 24, 2002 Updated: October 25, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Computer Associates Unknown
Notified: October 24, 2002 Updated: October 24, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Covalent Unknown
Notified: October 24, 2002 Updated: October 25, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
D-Link Systems Unknown
Notified: October 24, 2002 Updated: October 24, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Data Fellows Unknown
Notified: October 24, 2002 Updated: October 31, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Data General Unknown
Notified: October 24, 2002 Updated: October 31, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Debian Linux Unknown
Notified: October 24, 2002 Updated: October 27, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Engarde Unknown
Notified: October 24, 2002 Updated: October 28, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
F-Secure Unknown
Notified: October 24, 2002 Updated: October 25, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
F5 Networks, Inc. Unknown
Notified: October 24, 2002 Updated: October 24, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
FreeBSD, Inc. Unknown
Notified: October 24, 2002 Updated: October 25, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Intel Unknown
Notified: October 24, 2002 Updated: October 25, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Interlink Networks Unknown
Notified: October 24, 2002 Updated: October 24, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Juniper Networks, Inc. Unknown
Notified: October 24, 2002 Updated: October 24, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Lachman Unknown
Notified: October 24, 2002 Updated: October 31, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Lucent Technologies Unknown
Notified: October 24, 2002 Updated: October 24, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Macromedia Inc. Unknown
Notified: October 24, 2002 Updated: October 28, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Mandriva, Inc. Unknown
Notified: October 24, 2002 Updated: October 25, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Mandriva, Inc. Unknown
Notified: October 24, 2002 Updated: October 28, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
MontaVista Software, Inc. Unknown
Notified: October 24, 2002 Updated: October 28, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Motorola Unknown
Notified: October 24, 2002 Updated: October 25, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Multinet Unknown
Notified: October 24, 2002 Updated: October 28, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
NEC Corporation Unknown
Notified: October 24, 2002 Updated: October 25, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
NetBSD Unknown
Notified: October 24, 2002 Updated: October 28, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Network Appliance Unknown
Notified: October 24, 2002 Updated: October 24, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Nortel Networks, Inc. Unknown
Notified: October 24, 2002 Updated: October 28, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Openwall GNU/*/Linux Unknown
Notified: October 24, 2002 Updated: October 27, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Oracle Corporation Unknown
Notified: October 24, 2002 Updated: October 24, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
RADIUSClient Unknown
Notified: October 24, 2002 Updated: October 27, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Red Hat, Inc. Unknown
Notified: October 24, 2002 Updated: October 27, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Riverstone Networks Unknown
Notified: October 24, 2002 Updated: October 28, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
SGI Unknown
Notified: October 24, 2002 Updated: March 14, 2003
Statement Date: March 13, 2003
Status
Unknown
Vendor Statement
SGI acknowledges the vulnerabilities reported by CERT VU#464113 and is currently investigating. This is being tracked as SGI Bug# 871383. No further information is available at this time.
For the protection of all our customers, SGI does not disclose, discuss or confirm vulnerabilities until a full investigation has occurred and any necessary patch(es) or release streams are available for all vulnerable and supported IRIX operating systems. Until SGI has more definitive information to provide, customers are encouraged to assume all security vulnerabilities as exploitable and take appropriate steps according to local site security policies and requirements. As further information becomes available, additional advisories will be issued via the normal SGI security information distribution methods including the wiretap mailing list on http://www.sgi.com/support/security/.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
SUSE Linux Unknown
Notified: October 24, 2002 Updated: October 28, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Sequent Computer Systems, Inc. Unknown
Notified: October 24, 2002 Updated: October 25, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Sony Corporation Unknown
Notified: October 24, 2002 Updated: October 27, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Sophos Unknown
Notified: October 24, 2002 Updated: October 31, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Symantec Corporation Unknown
Notified: October 24, 2002 Updated: April 01, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
The SCO Group (SCO Unix) Unknown
Notified: October 24, 2002 Updated: October 27, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Unisphere Networks Unknown
Notified: October 24, 2002 Updated: October 31, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Unisys Unknown
Notified: October 24, 2002 Updated: October 24, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Wind River Systems, Inc. Unknown
Notified: October 24, 2002 Updated: October 27, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Wirex Unknown
Notified: October 24, 2002 Updated: October 31, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
XTRADIUS Unknown
Notified: October 24, 2002 Updated: October 31, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
YARD RADIUS Unknown
Notified: October 24, 2002 Updated: October 31, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
- http://hypermail.idiosynkrasia.net/linux-kernel/archived/2002/week46/1137.html
- http://www.securityfocus.com/archive/1/296122/2002-10-19/2002-10-25/2
- http://www.securityfocus.com/archive/1/296558/2002-10-19/2002-10-25/1
- http://www.uwsg.iu.edu/hypermail/linux/kernel/0210.3/0365.html
- http://www.cis.ohio-state.edu/cgi-bin/rfc/rfc1644.html
- http://www.packetfactory.net/projects/nemesis/
- http://www.ibiblio.org/pub/docs/rfc/rfc793.txt
- http://www.kb.cert.org/vuls/id/776781
- http://www.kohala.com/start/ttcp.html
Acknowledgements
This issue was initially described by Paul Starzetz in a mail message sent to the Bugtraq mailing list. We also thank Florian Weimer, Avi Freedman, Alan Cox, and David Waitzman for their invaluable feedback on this subject.
This document was written by Ian A Finlay.
Other Information
| CVE IDs: | CVE-2002-2438 |
| Severity Metric: | 32.25 |
| Date Public: | 2002-10-18 |
| Date First Published: | 2003-03-20 |
| Date Last Updated: | 2012-02-03 18:46 UTC |
| Document Revision: | 91 |