[32809] in bugtraq
RE: A new TCP/IP blind data injection technique?
daemon@ATHENA.MIT.EDU (David Gillett)
Thu Dec 11 13:56:39 2003
Reply-To: <gillettdavid@fhda.edu>
From: "David Gillett" <gillettdavid@fhda.edu>
To: "'Michal Zalewski'" <lcamtuf@ghettot.org>, <bugtraq@securityfocus.com>
Cc: <full-disclosure@netsys.com>
Date: Thu, 11 Dec 2003 08:38:00 -0800
Message-ID: <08cc01c3c005$2471c0b0$6e811299@HURON>
MIME-Version: 1.0
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: 7bit
In-Reply-To: <Pine.LNX.4.58.0312110022340.8651@nimue.bos.bindview.com>
> -----Original Message-----
> From: Michal Zalewski [mailto:lcamtuf@ghettot.org]
>
<snip>
> 1. Path MTU discovery (DF set) prevents fragmentation [*]; some modern
> systems (Linux) default to this mode - although PMTU discovery is
> also known to cause problems in certain setups, so it is not always
> the best way to stop the attack.
>
> [*] Also note that certain types of routers or tunnels tend to
> ignore DF flag, possibly opening this vector again.
<snip>
> Note that this has nothing to do with old firewall bypassing techniques
> and other tricks that used fragmentation to fool IDSes and so on -
> mandatory defragmentation of incoming traffic on perimeter devices will
> not solve the problem.
I concluded some time back -- coming at it from an entirely different
angle from either of these -- that IP-layer fragmentation and reassembly
was fatally flawed. All sane implementations should set DF, and all but
the most secure of tunnels should honour it.
David Gillett
