IP fragment reassembly code can be tricked to cause kernel panic
| freebsd-ip-frag-dos (1389) |  Medium Risk |
Description:
The IP fragment reassembly code in FreeBSD is vulnerable to a denial of service attack that can lead to a kernel panic. An attacker can send malformed IP packets to the FreeBSD device where the reassembly code assembles them into an invalid UDP datagram to cause the kernel to panic and crash. The system must be restarted to regain normal functionality.
Platforms Affected:
- FreeBSD, FreeBSD 3.0
- FreeBSD, FreeBSD CURRENT
Remedy:
For FreeBSD 3.0:
Upgrade to the latest version of FreeBSD (3.0 dated 1998/10/27 or later), as listed in FreeBSD Security Advisory FreeBSD-SA-98:08. See References.
For FreeBSD-current dated prior to 1998/10/27:
Upgrade to the latest version of FreeBSD (FreeBSD-current dated 1998/10/27 or later), as listed in FreeBSD Security Advisory FreeBSD-SA-98:08. See References.
Consequences:
Denial of Service
References:
- FreeBSD Security Advisory FreeBSD-SA-98:08, IP fragmentation denial of service at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/old/FreeBSD-SA-98:08.fragment.asc.
- BID-120: Multiple Vendor TCP/IP Implementations Vulnerability
- CVE-1999-0052: IP fragmentation denial of service in FreeBSD allows a remote attacker to cause a crash.
- OSVDB ID: 908: Multiple BSD TCP/IP Stacks IP Fragmentation Remote DoS
Reported:
Nov 04, 1998
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net