Netstat -vat by Sean Michael Kerner (bio )

A command line view of IT

« Why did open source group buy Microsoft patents? | Sean Michael Kerner Blog | Red Hat accuses Microsoft of patent FUD »

Cisco fixes massive TCP flaw

By Sean Michael Kerner on September 9, 2009 9:11 AM

From the 'Bigger Than DNS' files:

Cisco (NASDAQ:CSCO) now has a critical patch out for its IOS operating system fixing a TCP flaw that could trigger a Denial of Service (DoS) condition.

The TCP flaw is similar in nature to one that Microsoft patched as part of its September Patch Tuesday update. TCP is the core transport protocol for most web traffic and the flaw is one that is not trivial.

"By manipulating the state of a TCP connection, an attacker could force the TCP connection to remain in a long-lived state, possibly indefinitely," Cisco's warns in its advisory. "If enough TCP connections are forced into a long-lived or indefinite state, resources on a system under attack may be consumed, preventing new TCP connections from being accepted."

In other words, a flaw in TCP could have enable a DoS attack.

According to Cisco's advisory, actually triggering the DoS requires the attacker to complete a TCP three-way handshake with a vulnerable system.

Such an attack was made simple in 2008 by way of a tool called Sockstress which was released by outpost24 security researchers. According the Sockstress website the tool is able to hep security researchers test for a generic issue that affects the availability of TCP services and the issue could be used to create a Denial of Service attack.

Why then if a tool has been available for a year has it taken so long for this issue to be fixed?

The answer in my opinion is relatively straightforward. For better or for worse, DoS attacks are a known commodity and can usually be prevented or redirected using a number of different techniques. Yes, it's better to fix the root cause, and now both Microsoft and Cisco have done that. The reality is that, to the best of my knowledge there has not been a widespread TCP attack exploiting this vulnerability.

Are other vendors at risk? I don't doubt it. The ability to keep open a TCP connection is also a feature that is sometimes required by streaming media services.

Will other vendors issue patches? I also think that's likely over time.

Should we panic? I don't think so. DoS attacks are something that all Internet users need protections against. Eliminating root causes is the right thing to do, but sometimes the band-aid solutions work well enough too.

Permalink | Comments (0) | TrackBacks (0) | Share