■コメント
複数のベンダーでTCP/IPに脆弱性があり、サービス不能攻撃を受ける恐れがあります。
この脆弱性を利用した攻撃を検知する為のシグネチャです。
■シグネチャの説明
ICMPタイプ3(目的地手の届かない)コード2(プロトコル手の届かない)を検出します。
http://www.iss.net/security_center/static/17170.php
■実証コード
[root@linux ICMP_Protocol_Unreachable_TCP]# ./HOD-icmp-attacks-poc
(MS05-019) (CISCO:20050412)
ICMP attacks against TCP (Proof-of-Concept)
Copyright (c) 2004-2005 .: houseofdabus :.
Usage:
./HOD-icmp-attacks-poc <-fi:SRC-IP> <-ti:VICTIM-IP> <-fi:SRC-PORT> [-tp:int] [-a:int] [-n:int]
-fi:IP From (sender) IP address
-ti:IP To (target) IP address
-fp:int Target open TCP port number
(for example - 21, 25, 80)
-tp:int Inicial value for bruteforce (sender) TCP port number
(default: 0 = range of ports 0-65535)
-n:int Number of packets
-a:int ICMP attacks:
1 - Blind connection-reset attack
(ICMP protocol unreachable)
2 - Path MTU discovery attack
(slow down the transmission rate)
3 - ICMP Source Quench attack
[root@linux ICMP_Protocol_Unreachable_TCP]# ./HOD-icmp-attacks-poc -ti:192.168.221.180 -tp:80
(MS05-019) (CISCO:20050412)
ICMP attacks against TCP (Proof-of-Concept)
Copyright (c) 2004-2005 .: houseofdabus :.
[*] From IP: <192.168.0.1>, port: 80
[*] To IP: <192.168.221.180>, port: 80
[*] Count: 1
■Proventiaでの検知(IDS)
■参考情報
Internet-Draft of ICMP attacks
ICMP attacks against TCP draft-gont-tcpm-icmp-attacks-00.txt
http://www.ietf.org/internet-drafts/draft-gont-tcpm-icmp-attacks-00.txt
OpenBSD 3.4 errata Web site
027: RELIABILITY FIX: August 25, 2004
http://www.openbsd.org/errata34.html
LWN.net Web site
LWN: 2.6.9-rc3 long-format changelog
http://lwn.net/Articles/104532/
Cisco Web site
Cisco IP Phone 7970G Release Notes for Firmware Release 6.0(1) SR1 for Cisco CallManager Versions 3.3 and 4.0
http://www.cisco.com/univercd/cc/td/doc/product/voice/c_ipphon/english/ipp7970/relnote/797060s1.htm
Gont's Web site
ICMP attacks against TCP
http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html
NISCC Vulnerability Advisory 532967
Vulnerability Issues in ICMP packets with TCP payloads
http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en
Cisco Security Advisory 2005 April 12 1200 UTC (GMT)
Crafted ICMP Messages Can Cause Denial of Service
http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml
Microsoft Security Bulletin MS05-019
Vulnerabilities in TCP/IP Could Allow Remote Code Execution and Denial of Service (893066)
http://www.microsoft.com/technet/security/Bulletin/MS05-019.mspx
Secunia Security Advisory: SA14904
Cisco Various Products ICMP Message Handling Denial of Service
http://secunia.com/advisories/14904/
CERT Vulnerability Note VU#222750
Network Appliance Information for VU#222750
http://www.kb.cert.org/vuls/id/JGEI-69DM7V
NetApp Web site
NetApp On the Web
http://now.netapp.com/
Secunia Security Advisory: Sa14950
Juniper Networks JUNOS ICMP Message Handling Denial of Service
http://secunia.com/advisories/14950/
Secunia Security Advisory: SA14937
Network Appliance Data ONTAP ICMP Message Handling Denial of Service
http://secunia.com/advisories/14937/
Internet-Draft of ICMP attacks
ICMP attacks against TCP draft-gont-tcpm-icmp-attacks-03.txt
http://www.ietf.org/internet-drafts/draft-gont-tcpm-icmp-attacks-03.txt
SecurityTracker Alert ID: 1013696
VxWorks ICMP Processing Errors Let Remote Users Deny Service
http://www.securitytracker.com/alerts/2005/Apr/1013696.html
SecurityTracker Alert ID: 1013698
WatchGuard Firebox ICMP Processing Errors Let Remote Users Deny Service
http://www.securitytracker.com/alerts/2005/Apr/1013698.html
CIAC INFORMATION BULLETIN P-177
Vulnerabilities in TCP-IP (893066)
http://www.ciac.org/ciac/bulletins/p-177.shtml
CIAC INFORMATION BULLETIN P-181
Cisco Products Vulnerable to DoS via Crafted ICMP Messages
http://www.ciac.org/ciac/bulletins/p-181.shtml
BugTraq Mailing List, Thu May 26 2005 - 12:08:50 CDT
[security bulletin] SSRT4884 rev.0 - HP-UX TCP/IP Remote Denial of Service (DoS)
http://archives.neohapsis.com/archives/bugtraq/2005-05/0301.html
Hewlett-Packard Company Web site
IT Resource Center - login / register
http://www1.itrc.hp.com/service/cki/secBullArchive.do?admint=-682735245+1116276188578+28353475
SecurityTracker Alert ID: 1014505
HP Tru64 TCP/IP ISN and ICMP Processing Flaws Let Remote Users Deny Service
http://www.securitytracker.com/alerts/2005/Jul/1014505.html
Secunia Security Advisory: SA16126
Blue Coat Products ICMP Message Handling Denial of Service
http://secunia.com/advisories/16126/
Blue Coat Security Advisory July 19, 2005
Security Advisory: ICMP Error Message Vulnerabilities
http://www.bluecoat.com/support/knowledge/advisory_icmp_error_message_vulnerabilities.html
SecurityTracker Alert ID: 1014534
Blue Coat ProxySG Error in Processing TCP Sequence Numbers in ICMP Messages Lets Remote Users Deny Service
http://www.securitytracker.com/alerts/2005/Jul/1014534.html
BlueCoat Download Web page
ProxySG Secure Proxy Appliance
http://download.bluecoat.com/release/SGOS3/index.html
SecurityTracker Alert ID: 1014533
Blue Coat Spyware Interceptor Error in Processing TCP Sequence Numbers in ICMP Messages Lets Remote Users Deny Service
http://www.securitytracker.com/alerts/2005/Jul/1014533.html
SecurityTracker Alert ID: 1014532
Blue Coat Director Error in Processing TCP Sequence Numbers in ICMP Messages Lets Remote Users Deny Service
http://www.securitytracker.com/alerts/2005/Jul/1014532.html
CVE
CVE-2004-0790
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0790