OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 1st quarter (Jan-Mar) 1995: Re: Blind IP Spoofing Attacks.

Re: Blind IP Spoofing Attacks.

Perry E. Metzger (perryimsi.com)
Tue, 24 Jan 1995 19:16:05 -0500 

Timothy Newsham says:
>   Just wanted to discuss a minor point in the CERT and other
> advisories.  They mention that NFS and Sun RPC in general are
> vulnerable to the sequence number attack.  It is true that
> nfs and other rpc's do rely on IP address for authentication
> but I dont see how they are vulnerable to an attack.  You
> need to see the reply in order to get a filehandle in order
> to do anything with nfs.  As for Sun RPC, it doesn't trust
> any host as its just a tool for writing protocols.  Are
> there other RPC protocols which are vulnerable to this
> attack?  Am I overlooking something about NFS?  Did someone
> just put 2 (fake source IP) and 2 (protocol relies on IP
> for authentication) together and get 3 (NFS is vulnerable
> to this attack)?

Solaris 2.X has "fixed" source routes so that they work, and has RPC
over TCP, including NFS over TCP. That means that you could indeed
make some nasty uses of IP spoofing in conjunction with NFS.

Myself, I consider NFS to be highly insecure and always advice clients
to hide it behind application level firewalls.

Perry