Date: Fri, 09 Nov 2012 01:15:15 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: CVE request --- acceptation of overlapping ipv6 fragments -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11/08/2012 03:15 PM, Petr Matousek wrote: > Accepting overlapping fragmented ipv6 packets can lead to > Operating Systems (OS) fingerprinting, IDS/IPS insertion/evasion, > firewall evasion. > > Do not accept such packets. > > Linux kernel upstream fix: > http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=70789d7052239992824628db8133de08dc78e593 > > References: http://tools.ietf.org/rfc/rfc5722.txt > https://media.blackhat.com/bh-eu-12/Atlasis/bh-eu-12-Atlasis-Attacking_IPv6-WP.pdf > > Thanks, So the rational here is that: 1) The RFC says overlapping IPv6 fragments should be dropped (in fact all the fragments for that datagram should be dropped). 2) Generally speaking there is no real legitimate case for overlapping IPv6 (or IPv4) fragments, and in fact they are quite dangerous: http://www.ietf.org/proceedings/72/slides/6man-5.pdf - -Overlapping fragments were allowed in the original IPv4 specification (RFC791) - -RFC1858 described an overlapping fragment attack that can be used to overwrite the TCP flags inside a packet IPv6 datagrams can include a destination options header - -This header belongs to the fragmentable part of the datagram - -TCP header can be much further into the fragmentable part - -Makes it possible to even overwrite port info. So basically IPv6 overlapping fragments are quite dangerous and can potentially be used to bypass firewalls/IDS/NIDS/etc. Also I'm guessing there are a lot of "embedded" (not sure what term to use when network devices now have full computers in them, e.g. photocopiers) IPv6 stacks that will not handle overlapping fragments (crash, memory overwrite, who knows) and cannot be upgraded by users (since the devices are not supported/not supported properly by the makers). So in a nutshell by not implementing RFC5722 we allow all manner of poorly defined and probably unwanted behaviours to take place, additionally we may end up passing nasty traffic to back end systems that cannot handle it well (and are expecting the front end machines to sanitize the traffic). So to this end I am assigning CVE-2012-4444 (been saving it, it's easy to remember =) for "failure to implement RFC5722 properly, allowing overlapping fragmented IPv6 packets to be processed or passed to other systems resulting in all sorts of potential unknown badness with unknown consequences". It looks like more than just Linux is affected, so if you know of other systems that are affected by this please reply to this thread so we have a list. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBAgAGBQJQnLuTAAoJEBYNRVNeJnmTN3wP/28+RpDqy+LOh9cvInOhPUpo LROLLXnPsSo12L/QD+SUch9BWrky/tb9k4wZNilt4E4ANIPYxLHlCpGPA5CzTnMP DfZ01VK4LCM1PLJXXmnkeltGS+TKKQg2eb5gKT8CcCpaJggnnLAmvpByykglSd48 xESLbirwK4ZADhnXo01OjZUgHH+osh+0xrXKUmAEV3vs79Tiv2W26/wFIlFP9zbJ bsI2XyyycvC2O7YErh5Hf3OuQCZd9xBWr7oe0Y7IHN6WSzlZOuwvLoXqqp8f+kss aRRKUIrqnARvEH6kCMDx87hbitI1ChwD/EChPzZPJuS4LYiVjwEysot1hS+3L7rv +49mazvMHinJumCnlmktpBRQEgP0qFYEf3QATTRAJhwDEsE1w/QyNbw1KSiDQHEk k3rbRmoUNs0akLFhkMJwslVPQAUZvfBueH2pk68ssKrXVMaWtE/wpkAHD3+yZpWK BbaxAerbYrc+2DgjPoAvwZEaGfp9S78u9IukabdxaaMPkXlhRptiJJf1yFgw95PV 3h1ceptHrxG2V+dPA94Bxah/QT0qFj/UkaNoOsyETDU7YUZ87w77QsF9QfFJ7Tj1 OcabyWtXkCvbZbveCybD+knxwQhZW0rdee6lWimi5L8Org2rZwnRNi2pHrcQ/ZuN U6wk/FHC3M/YcuBu6ZJZ =tcuu -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.