Re: Blind IP Spoofing Attacks.

mouseCollatz.McRCIM.McGill.EDU

• Messages sorted by: [ date ][ thread ][ subject ][ author ]
• Next message: der Mouse: "Re: Recent troubles"
• Previous message: Mark: "ip spoofing..."
• Maybe in reply to: Timothy Newsham: "Blind IP Spoofing Attacks."
• Next in thread: Timothy Newsham: "Re: Blind IP Spoofing Attacks."

> They mention that NFS and Sun RPC in general are vulnerable to the
> sequence number attack.

This is only barely true.  UDP-based services are not vulnerable to
sequence number attacks because UDP doesn't have sequence numbers.  To
the extent that RPC services are provided over TCP, they are vulnerable
to the sequence number attack.

Of course, this is not to say that UDP services are secure.  Anyone who
can obtain file handles can fire unlink or write requests at your NFS
server.  (This is one reason why you may want to block port 2049 at
your firewall, and either block port 111 as well and/or run a
portmapper that doesn't do PMAPPROC_CALLIT.)

					der Mouse

			    mousecollatz.mcrcim.mcgill.edu

• Next message: der Mouse: "Re: Recent troubles"
• Previous message: Mark: "ip spoofing..."
• Maybe in reply to: Timothy Newsham: "Blind IP Spoofing Attacks."
• Next in thread: Timothy Newsham: "Re: Blind IP Spoofing Attacks."