Browse Prior Art Database

Protection Against a Variant of the Tiny Fragment Attack (RFC 1858) (RFC3128)

IP.com Disclosure Number: IPCOM000005312D
Original Publication Date: 2001-Jun-01
Included in the Prior Art Database: 2001-Aug-21
Document File: 6 page(s) / 8K

Publishing Venue

Internet Society Requests For Comment (RFCs)

Related People

I. Miller: AUTHOR

Abstract

This document discusses how RFC 1858 compliant filters can be vulnerable to a variant of the "Tiny Fragment Attack" described in section 3.1 of the RFC. This document describes the attack and recommends corrective action.

This text was extracted from a ASCII Text document.
This is the abbreviated version, containing approximately 44% of the total text.

Network Working Group I. Miller Request for Comments: 3128 Singularis Ltd Updates: 1858 June 2001 Category: Informational

Protection Against a Variant of the Tiny Fragment Attack

Status of this Memo

This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.

Copyright Notice

Copyright (C) The Internet Society (2001). All Rights Reserved.

Abstract

This document discusses how RFC 1858 compliant filters can be vulnerable to a variant of the "Tiny Fragment Attack" described in section 3.1 of the RFC. This document describes the attack and recommends corrective action.

1. Introduction

RFC 1858 provides an excellent description of a class of attack on Internet firewalls and proposes countermeasures. However one of these countmeasures, the "Indirect Method" (section 3.2.2) is vulnerable to a combination of two of the attacks described.

The attack combines the features of the "Tiny Fragment Attack" (section 3) and the "Overlapping Fragment Attack" (section 4).

1.1 The scope of the attack

Where the filtering rules allow incoming connections to a machine AND there other ports which allow only outgoing connections on the same host, the attack allows incoming connections to the supposedly outgoing-only ports.

Note that only the initial connection message need be fragmented. Once the connection is established further traffic on it is legal. The significance of this weakness will depend on the security policy in force.

Miller Informational [Page 1]

RFC 3128 Protection Against a Tiny Fragment Attack June 2001

2. The Tiny Overlapping Fragment Attack

The attack typically consists of sending three fragments.

Fragment 1: (Fragment offset 0; length 16) Includes whole header and is entirely legal. Typically it describes a SYN packet initiating a new TCP connection to a port on the target host that is allowed to receive incoming connections. e.g., Incoming connection to port 25 SMTP.

Fragment 2: (Fragment offset 0; length 8) Is only the first 8 bytes and could be legal depending on the other 8-bytes of the header, but is NOT legal combined with the corresponding bytes from Fragment 1. Such a fragment includes only the port numbers and sequence number from the TCP header. Typically this packet replaces the destination port number with a port number on which the destination host that is not allowed to receive incoming connections.

Fragment 3: (Fragment offset 2; length rest of message) Contains no header and completes the message. (This third fragment is not part of the attack. However Fragment 1 cannot be the complete message or it would be passed up to the application before Fragment 2 arrived so a third fragment is necessary.)

2.1 Example of the attack

Consider the following trivial set of rules for incoming packets:

No|Action Source| Dest. Flags Purpose Port Port 1 |Permit >1023 SMTP ANY Incoming E-mail 2 |Permit >1023 ANY Ack=1| Existing FTP data channel connections. 3 |Deny ANY ANY ANY Default d...