Chapter 14 - Network Protocols

blog December 19th, 2006

Overview

There were really two things on our mind when we were creating this chapter. First, auditing low-level networking code is a lot of fun, as the vulnerabilities one encounters tend to be creative and encompass design, logic, and implementation flaws. Second, every security professional needs to have a good handle on TCP/IP in order to evaluate the software that’s built on top of it. So, our goal with this chapter was to intersperse a discussion of the core protocols’ security-relevant attributes with lots of interesting vulnerabilities in the lower-level networking software that processes it.

External Resources

RFC 791 - Internet Protocol
W. Richard Steven’s TCP/IP Illustrated, Volume 1
RFC 826 - An Ethernet Address Resolution Protocol
IANA list of IP Parameters
RFC 768 - User Datagram Protocol
RFC 793 - Transmission Control Protocol

External References

Solaris IP Options code (Page 850)
Anthony Osborne’s Windows IP Source Routing Vulnerability (Page 853)
Adam Osuchowski and Tomasz Dubinski’s Netfilter TCP Option Advisory (page 868)
HERT FreeBSD ISN PRNG Advisory (page 877)
Zalewski’s "Strange Attractors and TCP/IP Sequence Number Analysis." (page 877)
Watson’s "Slipping In The Window." (page 879)
IETF’s "Improving TCP’s Robustness to Blind In-Window Attacks." (page 880)
Zalewski’s TCP Fragmentation Blind Spoofing Bugtraq Post (page 880)
Anthony Osborne’s Linux Blind TCP Spoofing Vulnerability (page 881)
CORE-SDI Snort TCP Stream Reassembly Vulnerability (page 885)

Mirrored Software

sniffer.c - IP Header Validation Vulnerability, page 837
linsniffer.c - IP Variable Length Options Vulnerability, page 838
tcpdump 3.5 - tcpdump Header Length Vulnerability, page 839
Snort 1.0 - Snort Header Validation Vulnerability, page 841
Linux 2.6.0 net/ipv4/netfilter/ip_tables.c - Netfilter IP Option Sign-Extension, page 868
Linux 2.2.0 drivers/char/random.c - Linux ISN Vulnerability, page 877
Linux 2.0.31 net/ipv4/ - Linux TCP Blind Spoofing Vulnerability, page 881
Snort 1.9.1 - Snort TCP Reassembly Vulnerability, page 885

Relevant Blog Posts

Zalewski-vision

Further Reading and Discussion

You should definitely check out everything Vern Paxson has ever written.

Also, you’ll probably very much enjoy Newsham and Ptacek’s "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection."

TCP/IP Illustrated, Volume 2: The Implementation is another good resource.

Dan Kaminksy does creative work.

One Response to “Chapter 14 - Network Protocols”

  1. # anonymouson 29 Dec 2006 at 1:31 am

    That’s Vern Paxson, with an ’s’.

Permanent Link | Trackback URI | Comments RSS

Leave a Reply