On 2010-02-11 22:55, JW wrote: > Recently we've had a scanning vendor tell us our Debian Lenny 5.0.3 is > vulnerable to CVE-2004-0230: > > TCP/IP Sequence Prediction Blind Reset Spoofing DoS > > "It may be possible to send spoofed RST packets to the remote system." > > " . . . vulnerable to a sequence number > approximation bug, which may allow an attacker to send > spoofed RST packets to the remote host and close established > connections . . . " > > When I tried to look up info about it - one pages lists "Linux" as vulnerable > (with no additional information) and I am not able to find anything about > Debian's status or relationship to it except possibly for > http://www.mail-archive.com/secure-testing-comm...@lists.alioth.debian.org/msg01390.html > > which possibly indicates it's fixed, or someone tried to fix it in 2005. >
That says: CVE-2004-0230 (TCP, when using a large Window Size, makes it easier for remote ...) NOT-FOR-US: famous TCP RST bug See here for more information, it seems it is something to care about only if you do BGP routing: http://lwn.net/Articles/81560/ See also redhat's statement on this: http://www.redhat.com/security/data/cve/CVE-2004-0230.html > Does anyone know anything about this? I'm needing some kind of fix or > work-around so I can satisfy the scan vendor. > Not-a-bug? Best regards, --Edwin -- To UNSUBSCRIBE, email to debian-security-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org