=============================================================================
CERT* Advisory CA-97.28
Original issue date: Dec. 16, 1997
Last revised: --
Topic: IP Denial-of-Service Attacks
- -----------------------------------------------------------------------------
The CERT Coordination Center has received reports of two attack tools
(Teardrop and Land) that are being used to exploit two vulnerabilities in the
TCP/IP protocol. Both tools enable a remote user to cause a denial of service.
The CERT/CC team recommends installing patches from your vendor. Until you are
able to do so, we urge you to use the workaround described in Section
III.B. to reduce the likelihood of a successful attack using Land. There is
no workaround for Teardrop.
We will update this advisory as we receive additional information.
Please check our advisory files regularly for updates that relate to your
site.
- -----------------------------------------------------------------------------
I. Description
In recent weeks there has been discussion on public mailing lists about
two denial-of-service attack tools, Teardrop and Land. These attack tools
have similar effects on some systems (namely, causing the victim machine
to crash), but the tools exploit different vulnerabilities.
The CERT Coordination Center has received several reports of sites being
attacked by either one or both of these tools. It is important to note
that it may be necessary for a system administrator to apply separate
patches, if they exist, for each attack tool.
Topic 1 - Teardrop
Some implementations of the TCP/IP IP fragmentation re-assembly code do
not properly handle overlapping IP fragments. Teardrop is a widely
available attack tool that exploits this vulnerability.
Topic 2 - Land
Some implementations of TCP/IP are vulnerable to packets that are crafted
in a particular way (a SYN packet in which the source address and port
are the same as the destination--i.e., spoofed). Land is a widely
available attack tool that exploits this vulnerability.
II. Impact
Topic 1 - Teardrop
Any remote user can crash a vulnerable machine.
Topic 2 - Land
Any remote user that can send spoofed packets to a host can crash or
"hang" that host.
III. Solution
CERT/CC urges you to immediately apply vendor patches if they are
available. You may have to apply different patches for each attack tool.
You may want to use the workaround for Land, so please review
both Sections A and B below.
A. Consult your vendor
Appendix A contains information from vendors who provided input for
this advisory. We will update the appendix as we receive more
information. If you do not see your vendor's name, the CERT/CC did not
hear from that vendor. Please contact your vendor directly.
It is important to note that you may have to apply different
patches for each attack tool.
B. Apply the following workaround (Land only)
A workaround for the Land attack tool is to block IP-spoofed packets.
This workaround does not apply to the Teardrop attack tool because the
Teardrop attack does not rely on IP-spoofed packets.
Attacks like those of the Land tool rely on the use of forged packets,
that is, packets where the attacker deliberately falsifies the origin
address. With the current IP protocol technology, it is impossible to
eliminate IP-spoofed packets. However, you can reduce the likelihood of
your site's networks being used to initiate forged packets by filtering
outgoing packets that have a source address different from that of your
internal network.
Currently, the best method to reduce the number of IP-spoofed packets
exiting your network is to install filtering on your routers that
requires packets leaving your network to have a source address from
your internal network. This type of filter prevents a source IP
spoofing attack from your site by filtering all outgoing packets that
contain a source address from a different network.
A detailed description of this type of filtering is available in the
Internet Draft "Network Ingress Filtering: Defeating Denial of Service
Attacks which employ IP Source Address Spoofing" by Paul Ferguson of
Cisco Systems, Inc. and Daniel Senie of Blazenet, Inc. Note that
although this document is labeled as an IETF "working draft," the
content is complete and it is being proposed as an Informational RFC.
We recommend it to both Internet Service Providers and sites that
manage their own routers.
The document is currently available at
http://ds.internic.net/internet-drafts/draft-ferguson-ingress-filtering-03.txt
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Appendix A - Vendor Information
Below is a list of the vendors who have provided information for this
advisory. We will update this appendix as we receive additional information.
If you do not see your vendor's name, the CERT/CC did not hear from that
vendor. Please contact the vendor directly.
Cisco Systems
=============
Topic 1 - Teardrop
No feedback.
Topic 2 - Land
IOS/7000 software, Catalyst 5xxx and 29xx LAN switches, BPX and IGX WAN
switches and AXIS shelf appear to be vulnerable.
PIX firewall and Centri firewall are not vulnerable.
For more information reference URL:
http://www.cisco.com/warp/public/770/land-pub.shtml
Digital Equipment Corporation
=============================
Topic 1 - Teardrop
No feedback.
Topic 2 - Land
ULTRIX is not vulnerable.
The FreeBSD Project
===================
Topic 1 - Teardrop
CSRG 4.4 is not vulnerable.
Topic 2 - Land
No feedback.
Hewlett-Packard Corporation
===========================
Topic 1 - Teardrop
HP-UX versions 9.04-10.20 are not vulnerable.
Topic 2 - Land
No feedback.
IBM Corporation
===============
Topic 1 - Teardrop
AIX is not vulnerable.
Topic 2 - Land
AIX is not vulnerable.
Microsoft Corporation
=====================
Topic 1 - Teardrop
Windows NT 4.0 with SP 3 and post SP 3 fixes applied and Windows 95
with the appropriate patch are not vulnerable.
Patch information is available at URL:
ftp://ftp.microsoft.com/bussys/winnt/kb/Q154/1/74.TXT
Topic 2 - Land
Windows NT 4.0 with the appropriate patch is not vulnerable.
Patch information is available at URL:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
hotfixes-postSP3/land-fix/Q165005.txt
Windows 95 without the WinSock 2.0 Update is not vulnerable.
Patch information is available at URL:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
hotfixes-postSP3/land-fix/Q177539.TXT
NCR Corporation
===============
Topic 1 - Teardrop
NCR TCP/IP implementation is not vulnerable.
Topic 2 - Land
No feedback.
The NetBSD Project
==================
Topic 1 - Teardrop
Versions 1.2 and above are not vulnerable.
Topic 2 - Land
No feedback.
Red Hat Software
================
Topic 1 - Teardrop
Linux is not vulnerable.
Topic 2 - Land
Linux is not vulnerable.
- ---------------------------------------------------------------------------
The CERT Coordination Center thanks Paul Ferguson and Daniel Senie for
providing information on network ingress filtering.
- ----------------------------------------------------------------------------
If you believe that your system has been compromised, contact the CERT
Coordination Center or your representative in the Forum of Incident Response
and Security Teams (see http://www.first.org/team-info/).
CERT/CC Contact Information
- ----------------------------
Email cert@cert.org
Phone +1 412-268-7090 (24-hour hotline)
CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4)
and are on call for emergencies during other hours.
Fax +1 412-268-6989
Postal address
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
USA
Using encryption
We strongly urge you to encrypt sensitive information sent by email. We
can support a shared DES key or PGP. Contact the CERT/CC for more
information.
Location of CERT PGP key
ftp://ftp.cert.org/pub/CERT_PGP.key
Getting security information
CERT publications and other security information are available from
http://www.cert.org/
ftp://ftp.cert.org/pub/
CERT advisories and bulletins are also posted on the USENET newsgroup
comp.security.announce
To be added to our mailing list for advisories and bulletins, send
email to
cert-advisory-request@cert.org
In the subject line, type
SUBSCRIBE your-email-address
- ---------------------------------------------------------------------------
Copyright 1997 Carnegie Mellon University. Conditions for use, disclaimers,
and sponsorship information can be found in
http://www.cert.org/legal_stuff.html and ftp://ftp.cert.org/pub/legal_stuff .
If you do not have FTP or web access, send mail to cert@cert.org with
"copyright" in the subject line.
*CERT is registered in the U.S. Patent and Trademark Office.
- ---------------------------------------------------------------------------
This file: ftp://ftp.cert.org/pub/cert_advisories/CA-97.28.Teardrop_Land
http://www.cert.org
click on "CERT Advisories"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Revision history
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBNJaZMXVP+x0t4w7BAQETVwP/bJs/07PqnM5VxfNqj+Iw+eGORosq6Xyc
JQ7o69ePzo20pusBIhlb2DjrLAeEwlqzBwBV8W1Y/lujaWWLTsotPasMB7kK+dJp
sOBMAFwMb/RjawVnizs+F0V1JvqbQbIfUquaqursDUG7DRVDT9O8d7nzf4CS7n+M
VFgx9ryzcHc=
=hOK4
-----END PGP SIGNATURE-----