Security Alert: Multiple OS IP Fragmentation Memory Exhaustion Vulnerability
iDefense Alert: Remote exploitation of a new IP fragmentation attack can result in a system running out of memory, allowing a denial of service attack.Editors Note: A security alert is presented daily to eWEEK.com readers by iDefense Inc., a security research company based in Reston, Va. Severity: High Analysis: (iDEFENSE US) Remote exploitation of a new IP fragmentation attack present in multiple operating systems (such as Microsoft Corp.s Windows, Linux and Cisco Systems, Inc.s Cisco IOS) can result in a system running out of memory, allowing a denial of service (DoS).
Many types of fragmented network packets created (e.g., TCP-IP, UDP, ICMP, etc.) will work when sent to a remote host. For each attack, two packets are sent; the initial packet having data that indicates an offset of 0, and a second packet having an offset of 64800. This causes the target system to allocate a portion of memory for the remaining packets that will complete the original un-fragmented packet. For each attack, the target system will allocate 64 kilobytes of memory, which is held in reserve (typically for between 15 and 255 seconds).
Packet sniffers, such as TCPDUMP, can be used to detect exploitation if large amounts of fragmented packets are present on a network:
tcpdump -nn -v ip&32!=0
Recovery: Power cycling the router is required to resume normal operation.
Workaround: Disable the web-based administrative interface on the Cisco 675 router.
Vendor Fix: iDEFENSE is unaware of any vendor updates. These are likely to take some time in any event as they require modification to packet handling structures and algorithms used to process them. iDefense provides security intelligence to governments and Fortune 1000 organizations, and provides this daily threat alert to eWEEK.com Check out eWEEK.coms Security Center at http://security.eweek.com for security news, views and analysis. Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page: