Notified:  October 24, 2002 Updated: October 30, 2002

Statement Date:   October 30, 2002

Status

Not Affected

Vendor Statement

Cray, Inc. is not vulnerable as we provide no software that performs this type of function.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Updated:  October 25, 2002

Statement Date:   October 24, 2002

Status

Not Affected

Vendor Statement

This issue isn't relevant to any of our products.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Updated:  April 01, 2003

Statement Date:   March 27, 2003

Status

Not Affected

Vendor Statement

Foundry Networks does not produce stateful or packet filtering firewalls, but do support high speed packet filtering ACLs on its products. An ACL with the "established" operator turned on will filter on all TCP packets with the ACK (Acknowledgment) or RST (Reset) bits set to "1" (on) in the control filed of the TCP packet header. Current versions of shipping software will not permit unexpected combinations of SYN flags.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Notified:  October 24, 2002 Updated: December 03, 2002

Statement Date:   December 03, 2002

Status

Not Affected

Vendor Statement

Fujitsu's UXP/V OS is not vulnerable, because the relevant function is not supported under UXP/V.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Updated:  October 25, 2002

Statement Date:   October 24, 2002

Status

Not Affected

Vendor Statement

While we are a vendor of a variety of products that involved network security, none of the products currently include firewall functionality that would be susceptible to the type of attack described below. We will keep this notification on file to ensure that any new products we might develop in the future are not susceptible to this attack.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Notified:  October 24, 2002 Updated: May 10, 2005

Statement Date:   March 17, 2003

Status

Not Affected

Vendor Statement

SOURCE: Hewlett-Packard Company HP Services Software Security Response Team x-ref:SSRT2391 As further information becomes available HP will provide notice of the availability of any necessary patches through standard security bulletin announcements and be available from your normal HP Services support channel.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Notified:  October 24, 2002 Updated: April 01, 2003

Statement Date:   April 01, 2003

Status

Not Affected

Vendor Statement

The IBM AIX operating system is not vulnerable to the issues discussed in CERT Vulnerability Note VU#464113.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Updated:  March 18, 2003

Statement Date:   March 17, 2003

Status

Not Affected

Vendor Statement

Ingrian Networks products are application-level proxies. The type of attack detailed in VU#464113 cannot be used to bypass their security.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Notified:  October 24, 2002 Updated: March 14, 2003

Statement Date:   March 13, 2003

Status

Not Affected

Vendor Statement

Lotus does not ship firewalls or packet filters, so there is no vulnerability due to TCP/IP connection open semantics.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Notified:  October 24, 2002 Updated: October 29, 2002

Statement Date:   October 28, 2002

Status

Not Affected

Vendor Statement

Microsoft has thoroughly investigated this issue, and found that Microsoft's ISA Server firewall product is not affected by the scenario described in this report.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Updated:  March 14, 2003

Statement Date:   March 13, 2003

Status

Not Affected

Vendor Statement

NetScreen is not vulnerable to this issue.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Notified:  October 24, 2002 Updated: March 14, 2003

Statement Date:   October 25, 2002

Status

Not Affected

Vendor Statement

The stateful packet filter (pf) that ships with OpenBSD 3.0 and later is not vulnerable to the attacks described. pf uses real stateful TCP filtering and keeps track of established connections using a state table. It doesn't use any TCP flags to associate a packet with an established connection, instead it uses source and destination addresses and ports to find matching state entries (and verifies sequence numbers against narrow windows). Filter rules specify which packets create state table entries, and the required TCP flags can be specified freely. It's possible to create state only for plain SYN packets or allow any combination of other TCP flags to do so. In no case any packet with any combination of TCP flags can bypass the policy defined in the rule set (due to the packet filter wrongly assuming it is part of an established connection), as only explicit rules can create state tables entries. To prevent SYN+RST packets from creating state, the option 'flags S/SAR' can be used (meaning 'SYN must be set, ACK and RST must not be set'). But even the common 'flags S/SA' will only create state when the remaining rule matches, allowing SYN+RST packets to establish only connections which are already allowed for plain SYNs.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Notified:  October 24, 2002 Updated: November 11, 2004

Status

Not Affected

Vendor Statement

+ Solaris is not vulnerable to this issue. + The SunScreen Firewall products only pass packets with the SYN bit set to a host that it has been configured to allow a connection to. Setting extra bits in a packet will not change this behaviour. In addition, the SunScreen TCP state engine will check that the following conform to RFC 793 before passing them: * Packets in the three-way handshake. * Packets with FIN bit set. * Packets with RST bit set.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Notified:  October 24, 2002 Updated: October 29, 2002

Statement Date:   October 28, 2002

Status

Not Affected

Vendor Statement

TrendMicro has been aware for some time of the potential problems that this TCP-Flag combination issue contains. TrendMicro has two products which make use of the network-layer, where these flags are used to identify the current session status. These products are GateLock and PC-cillin . Neither product is affected. PC-cillin is an antivirus and antihacker security solution for computers and PDAs. It includes a personal firewall. This firewall does not pass through undefined SYN,FIN combination packets to the protected local services/ports. TrendMicro GateLock is an all-in-one, plug-and-play Internet appliance designed for home and SOHO networks that uses a broadband connection. This appliance includes a stateful inspection firewall which does not allow the establishment of a session to the protected hosts in case of a SYN,FIN combination packet. All other TrendMicro gateway products are categorized as application-level firewalls. These products running in the application-layer. The underlaying OS is responsible for the three-way handshake.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Notified:  October 24, 2002 Updated: May 30, 2003

Statement Date:   December 10, 2002

Status

Not Affected

Vendor Statement

A response to this vulnerability is available from our web site: http://www.xerox.com/security.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.