Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via a blind throughput-reduction attack using spoofed Source Quench packets, aka the "ICMP Source Quench attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.

The vulnerability described in this article was initially fixed in earlier versions, but a regression was reintroduced in BIG-IP 12.x through13.x. For information about earlier versions, refer toK4583:
Insufficient validation of ICMP error messages - VU#222750 / CVE-2004-0790(9.x - 10.x).

Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the 'blind connection-reset attack.' NOTE:
CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. (CVE-2004-0790)

Impact

A remote attacker can interfere with the Path MTU Discovery process and cause a performance degradation or reset of FastL4 accelerated TCP connections by spoofing a specifically craftedInternet Control Message Protocol (ICMP) message.

This vulnerability only applies to FastL4 virtual servers on BIG-IP platforms with the embedded Packet Velocity Acceleration (ePVA) chip.The ePVA chip is a hardware acceleration Field Programmable Gate Array (FPGA) that delivers high-performance Layer 4 (L4) IPv4 throughput. ePVA chips are included on the following BIG-IP platforms :

B2100 Blade in the VIPRION C2400 or C2200 Chassis

B2150 Blade in the VIPRION C2400 or C2200 Chassis

B2250 Blade in the VIPRION C2400 or C2200 Chassis

B4300 Blade in the VIPRION C4480 or C4800 Chassis

B4340 Blade in the VIPRION C4480 or C4800 Chassis

BIG-IP 12000 series

BIG-IP 10000 series

BIG-IP 7000 series

BIG-IP 5000 series

BIG-IP i5000 series

BIG-IP i7000 series

BIG-IP i10000 series

The remote BIG-IP device is missing a patch required by a security advisory.

A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt ).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
Successful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.

s700_800 11.04 (VVOS) cumulative ARPA Transport patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running TCP/IP. This vulnerability could be     remotely exploited by an unauthorized user to cause a     Denial of Service(DoS). References: NISCC VU#532967,     CAN-2004-0790, CAN-2004-0791, CAN-2004-1060.
    (HPSBUX01164 SSRT4884)

  - A potential security vulnerability has been identified     with HP-UX running TCP/IP. The potential vulnerability     could be exploited remotely to cause a Denial of Service     (DoS). (HPSBUX02087 SSRT4728)

s700_800 11.00 cumulative ARPA Transport patch : 

A potential security vulnerability has been identified with HP-UX running TCP/IP. This vulnerability could be remotely exploited by an unauthorized user to cause a Denial of Service(DoS). References: NISCC VU#532967, CAN-2004-0790, CAN-2004-0791, CAN-2004-1060.

s700_800 11.23 cumulative ARPA Transport patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running TCP/IP. This vulnerability could be     remotely exploited by an unauthorized user to cause a     Denial of Service(DoS). References: NISCC VU#532967,     CAN-2004-0790, CAN-2004-0791, CAN-2004-1060.
    (HPSBUX01164 SSRT4884)

  - A potential security vulnerability has been identified     with HP-UX running TCP/IP (IPv4). This vulnerability     could be remotely exploited to cause a Denial of Service     (DoS). (HPSBUX01137 SSRT5954)

s700_800 11.11 cumulative ARPA Transport patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running TCP/IP (IPv4). This vulnerability     could be remotely exploited to cause a Denial of Service     (DoS). (HPSBUX01137 SSRT5954)

  - A potential security vulnerability has been identified     with HP-UX running TCP/IP. This vulnerability could be     remotely exploited by an unauthorized user to cause a     Denial of Service(DoS). References: NISCC VU#532967,     CAN-2004-0790, CAN-2004-0791, CAN-2004-1060.
    (HPSBUX01164 SSRT4884)

s700_800 11.00 ndd(1M) cumulative patch : 

A potential security vulnerability has been identified with HP-UX running TCP/IP. This vulnerability could be remotely exploited by an unauthorized user to cause a Denial of Service(DoS). References: NISCC VU#532967, CAN-2004-0790, CAN-2004-0791, CAN-2004-1060.

s700_800 11.04 (VVOS) ndd(1M) cumulative patch : 

A potential security vulnerability has been identified with HP-UX running TCP/IP. This vulnerability could be remotely exploited by an unauthorized user to cause a Denial of Service(DoS). References: NISCC VU#532967, CAN-2004-0790, CAN-2004-0791, CAN-2004-1060.

s700_800 11.11 cumulative ARPA Transport patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running TCP/IP. This vulnerability could be     remotely exploited by an unauthorized user to cause a     Denial of Service(DoS). References: NISCC VU#532967,     CAN-2004-0790, CAN-2004-0791, CAN-2004-1060.
    (HPSBUX01164 SSRT4884)

  - An HP-UX 11.11 machine with TRANSPORT patches     PHNE_24211, PHNE_24506, PHNE_25134, or PHNE_25642 may be     exposed to a denial of service through the malicious use     of the 'ndd' command. (HPSBUX00192 SSRT071390)

  - TCP Initial Sequence Number (ISN) randomization     specified in RFC 1948 is available for HP-UX.
    References: CVE-2001-0328, CERT CA-2001-09. (HPSBUX00205     SSRT080009)

Updated kernel packages that fix several security issues in Red Hat Enterprise Linux 2.1 are now available.

The Linux kernel handles the basic functions of the operating system.

This advisory includes fixes for the following security issues :

iSEC Security Research discovered a VMA handling flaw in the uselib(2) system call of the Linux kernel. A local user could make use of this flaw to gain elevated (root) privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1235 to this issue.

iSEC Security Research discovered a flaw in the page fault handler code that could lead to local users gaining elevated (root) privileges on multiprocessor machines. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0001 to this issue.

iSEC Security Research and Georgi Guninski independently discovered a flaw in the scm_send function in the auxiliary message layer. A local user could create a carefully crafted auxiliary message which could cause a denial of service (system hang). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1016 to this issue.

Kirill Korotaev found a flaw in load_elf_binary affecting kernels prior to 2.4.26. A local user could create a carefully crafted binary in such a way that it would cause a denial of service (system crash).
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1234 to this issue.

These packages also fix issues in the io_edgeport driver (CVE-2004-1017), a memory leak in ip_options_get (CVE-2004-1335), and missing VM_IO flags in some drivers (CVE-2004-1057).

A recent Internet Draft by Fernando Gont recommended that ICMP Source Quench messages be ignored by hosts. A patch to ignore these messages is included.

All Red Hat Enterprise Linux 2.1 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

Updated kernel packages that fix several security issues in Red Hat Enterprise Linux 3 are now available.

The Linux kernel handles the basic functions of the operating system.

This advisory includes fixes for several security issues :

iSEC Security Research discovered a VMA handling flaw in the uselib(2) system call of the Linux kernel. A local user could make use of this flaw to gain elevated (root) privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1235 to this issue.

A flaw was discovered where an executable could cause a VMA overlap leading to a crash. A local user could trigger this flaw by creating a carefully crafted a.out binary on 32-bit systems or a carefully crafted ELF binary on Itanium systems. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0003 to this issue.

iSEC Security Research discovered a flaw in the page fault handler code that could lead to local users gaining elevated (root) privileges on multiprocessor machines. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0001 to this issue. A patch that coincidentally fixed this issue was committed to the Update 4 kernel release in December 2004. Therefore Red Hat Enterprise Linux 3 kernels provided by RHBA-2004:550 and subsequent updates are not vulnerable to this issue.

A flaw in the system call filtering code in the audit subsystem included in Red Hat Enterprise Linux 3 allowed a local user to cause a crash when auditing was enabled. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1237 to this issue.

Olaf Kirch discovered that the recent security fixes for cmsg_len handling (CVE-2004-1016) broke 32-bit compatibility on 64-bit platforms such as AMD64 and Intel EM64T. A patch to correct this issue is included.

A recent Internet Draft by Fernando Gont recommended that ICMP Source Quench messages be ignored by hosts. A patch to ignore these messages is included.

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

Updated kernel packages that fix several security issues in Red Hat
Enterprise Linux 3 are now available.

The Linux kernel handles the basic functions of the operating system.

This advisory includes fixes for several security issues :

iSEC Security Research discovered a VMA handling flaw in the uselib(2)
system call of the Linux kernel. A local user could make use of this
flaw to gain elevated (root) privileges. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-1235 to this issue.

A flaw was discovered where an executable could cause a VMA overlap
leading to a crash. A local user could trigger this flaw by creating a
carefully crafted a.out binary on 32-bit systems or a carefully
crafted ELF binary on Itanium systems. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2005-0003
to this issue.

iSEC Security Research discovered a flaw in the page fault handler
code that could lead to local users gaining elevated (root) privileges
on multiprocessor machines. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2005-0001 to this
issue. A patch that coincidentally fixed this issue was committed to
the Update 4 kernel release in December 2004. Therefore Red Hat
Enterprise Linux 3 kernels provided by RHBA-2004:550 and subsequent
updates are not vulnerable to this issue.

A flaw in the system call filtering code in the audit subsystem
included in Red Hat Enterprise Linux 3 allowed a local user to cause a
crash when auditing was enabled. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2004-1237
to this issue.

Olaf Kirch discovered that the recent security fixes for cmsg_len
handling (CVE-2004-1016) broke 32-bit compatibility on 64-bit
platforms such as AMD64 and Intel EM64T. A patch to correct this issue
is included.

A recent Internet Draft by Fernando Gont recommended that ICMP Source
Quench messages be ignored by hosts. A patch to ignore these messages
is included.

Note: The kernel-unsupported package contains various drivers and
modules that are unsupported and therefore might contain security
problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

Updated kernel packages that fix several security issues in Red Hat
Enterprise Linux 2.1 are now available.

The Linux kernel handles the basic functions of the operating system.

This advisory includes fixes for the following security issues :

iSEC Security Research discovered a VMA handling flaw in the uselib(2)
system call of the Linux kernel. A local user could make use of this
flaw to gain elevated (root) privileges. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-1235 to this issue.

iSEC Security Research discovered a flaw in the page fault handler
code that could lead to local users gaining elevated (root) privileges
on multiprocessor machines. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2005-0001 to this
issue.

iSEC Security Research and Georgi Guninski independently discovered a
flaw in the scm_send function in the auxiliary message layer. A local
user could create a carefully crafted auxiliary message which could
cause a denial of service (system hang). The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-1016 to this issue.

Kirill Korotaev found a flaw in load_elf_binary affecting kernels
prior to 2.4.26. A local user could create a carefully crafted binary
in such a way that it would cause a denial of service (system crash).
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-1234 to this issue.

These packages also fix issues in the io_edgeport driver
(CVE-2004-1017), a memory leak in ip_options_get (CVE-2004-1335), and
missing VM_IO flags in some drivers (CVE-2004-1057).

A recent Internet Draft by Fernando Gont recommended that ICMP Source
Quench messages be ignored by hosts. A patch to ignore these messages
is included.

All Red Hat Enterprise Linux 2.1 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

ID	Name	Product	Family	Severity
100000	F5 Networks BIG-IP : Insufficient validation of ICMP error messages (K23440942)	Nessus	F5 Networks Local Security Checks	critical
86016	F5 Networks BIG-IP : Insufficient validation of ICMP error messages (SOL4583)	Nessus	F5 Networks Local Security Checks	medium
48985	Crafted ICMP Messages Can Cause Denial of Service - Cisco Systems	Nessus	CISCO	medium
19486	HP-UX PHNE_33427 : s700_800 11.04 (VVOS) cumulative ARPA Transport patch	Nessus	HP-UX Local Security Checks	high
19363	HP-UX PHNE_33395 : HP-UX TCP/IP Remote Denial of Service (DoS) (HPSBUX01164 SSRT4884 rev.9)	Nessus	HP-UX Local Security Checks	medium
19362	HP-UX PHNE_32606 : s700_800 11.23 cumulative ARPA Transport patch	Nessus	HP-UX Local Security Checks	medium
18608	HP-UX PHNE_33159 : s700_800 11.11 cumulative ARPA Transport patch	Nessus	HP-UX Local Security Checks	medium
18399	HP-UX PHNE_26125 : HP-UX TCP/IP Remote Denial of Service (DoS) (HPSBUX01164 SSRT4884 rev.9)	Nessus	HP-UX Local Security Checks	medium
18398	HP-UX PHNE_26076 : HP-UX TCP/IP Remote Denial of Service (DoS) (HPSBUX01164 SSRT4884 rev.9)	Nessus	HP-UX Local Security Checks	medium
16508	HP-UX PHNE_25644 : s700_800 11.11 cumulative ARPA Transport patch	Nessus	HP-UX Local Security Checks	medium
16244	RHEL 2.1 : kernel (RHSA-2005:016)	Nessus	Red Hat Local Security Checks	critical
16211	RHEL 3 : kernel (RHSA-2005:043)	Nessus	Red Hat Local Security Checks	medium
801604	Red Hat 2005-043 Security Check	Log Correlation Engine	Generic	high
801603	Red Hat 2005-016 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2004-0791

high

Tenable Plugins

critical

medium

medium

high

medium

medium

medium

medium

medium

medium

critical

medium

high

high