DoS: ANS Interlock Firewall

lurkerCC.GATECH.EDU

• Messages sorted by: [ date ][ thread ][ subject ][ author ]
• Next message: Aleph One: "Administrivia"
• Previous message: Matt Conover: "Re: Sun libnsl lameness"

        This may be repeated information but a quick search of the
archives didn't turn anything up, so here goes...

        There is a problem in the TCP/IP stack of ANS's Interlock Internet
Firewall product.  Sending the correct series of packet fragments will
cause the machine to reboot.  Bellow is part of a problem description
provided by ANS.  A patch is available.

>The 1st fragment contains all (or most) of the packets payload and it
>incorrectly indicates that no other fragments are coming (the IP
>more fragment field is not set).  The next fragment is sent with a
>zero length and uses the same packet identifier (indicating its
>another part of the earlier packet).  This packet also does not
>indicate that more fragments are coming.  The result is a zero length
>fragment arrives at the InterLock and gets processed by the Solaris
>fragment handling code.  Unfortunately, the Solaris fragment timeout
>handling code (which gets involved 60 seconds later) doesnt properly
>handle the zero length fragment and its panics the box during cleanup.

        -The Lurker

• Next message: Aleph One: "Administrivia"
• Previous message: Matt Conover: "Re: Sun libnsl lameness"