FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

kernel -- TCP connection stall denial of service

Affected systems
5.4 <= FreeBSD < 5.4_3
5.* <= FreeBSD < 5.3_17
4.11 <= FreeBSD < 4.11_11
FreeBSD < 4.10_16

Details

VuXML ID 3ec8f43b-e8ef-11d9-b875-0001020eed82
Discovery 2005-06-29
Entry 2005-06-29
Modified 2005-07-06

Problem Description

Two problems have been discovered in the FreeBSD TCP stack.

First, when a TCP packets containing a timestamp is received, inadequate checking of sequence numbers is performed, allowing an attacker to artificially increase the internal "recent" timestamp for a connection.

Second, a TCP packet with the SYN flag set is accepted for established connections, allowing an attacker to overwrite certain TCP options.

Impact

Using either of the two problems an attacker with knowledge of the local and remote IP and port numbers associated with a connection can cause a denial of service situation by stalling the TCP connection. The stalled TCP connection my be closed after some time by the other host.

Workaround

In some cases it may be possible to defend against these attacks by blocking the attack packets using a firewall. Packets used to effect either of these attacks would have spoofed source IP addresses.

References

CERT/CC Vulnerability Note 637934
CVE Name CVE-2005-0356
CVE Name CVE-2005-2068
FreeBSD Advisory SA-05:15.tcp