Project

General

Profile

Actions

Security #4504

closed

tcp: Evasion possibility on wrong/unexpected ACK value in crafted SYN packets

Added by Peter Manev over 1 year ago. Updated 12 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Label:
Needs backport to 5.0, Needs backport to 6.0
Git IDs:

0d81173d6e912f4be9e3e8f7593d779d8ffed52f
556570f7dd7f21f11cffda5ebcb72738a29cbb90
2c8c043185a4700b042d2154f5076f1c82e5394b

Severity:
CRITICAL

Description

affected versions: all

Please see the pcap attached.
Basically it logs no HTTP even with midstream enabled.

The problem is the first packet right away as it has ACK value that we check and disregard the whole flow/session.But Windows and Linux accept those and everyone else it seems.

Please also see attached a test case(py file) and a patch by Eric.

The pcap can not be shared or made public except of the devs with access to this issue of course.


Files


Related issues 2 (0 open2 closed)

Copied to Security #4512: Evasion possibility on wrong/unexpected ACK value in crafted SYN packetsClosedVictor JulienActions
Copied to Security #4513: Evasion possibility on wrong/unexpected ACK value in crafted SYN packetsClosedJeff LucovskyActions
Actions

Also available in: Atom PDF