A TCP weakness in Linux systems allows network traffic hijack
1–10 of 25 posts
Re: A TCP weakness in Linux systems allows network traffic hijack
#2I've found this on isssource and am surprised that it has not spread like wildfire. If the claims are true then this is an issue that should be taken seriously. Posting here for discussion.
Re: A TCP weakness in Linux systems allows network traffic hijack
#3Wasn't it fixed long, long ago? As I remember, kernel developers were fixing TCP sequence numbers at some point.
Re: A TCP weakness in Linux systems allows network traffic hijack
#4Wasn't it fixed long, long ago? As I remember, kernel developers were fixing TCP sequence numbers at some point.
I vaguely remember something around a potential fix but I lost track of it. The strange thing is that this appeared yesterday. I haven't had time to actually test this, am just looking to see what the community knows, whether someone could confirm this.
Re: A TCP weakness in Linux systems allows network traffic hijack
#5Re: A TCP weakness in Linux systems allows network traffic hijack
#6Wasn't it fixed long, long ago? As I remember, kernel developers were fixing TCP sequence numbers at some point.
There's been a few TCP sequence related vulnerabilities over the years, but this is slightly different - it's actually a problem with how ACKs are processed, making it far easier than it should be to conduct a well-known attack type (blind in-window).
EDIT: it's of course still sequence related, but a new vuln, not a restarting of an older, fixed one.
Re: A TCP weakness in Linux systems allows network traffic hijack
#7Currently listed as vulnerable and unfixed in Debian: https://security-tracker.debian.org/tracker/CVE-2016-5696
Re: A TCP weakness in Linux systems allows network traffic hijack
#8I've found this on isssource and am surprised that it has not spread like wildfire. If the claims are true then this is an issue that should be taken seriously. Posting here for discussion.
So far it looks pretty real. CVE exists[0], been picked up by RedHat[1].
It's possible that they're wrong - I haven't personally verified it - but at this point it'd be very surprising. Apart from anything else, these are serious researchers with real track records.
I'm proceeding on the assumption that it's real, and working towards ensuring everything (with a kernel >= 3.6 and 0: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5696 1: https://access.redhat.com/security/cve/cve-2016-5696
Re: A TCP weakness in Linux systems allows network traffic hijack
#9Here's the commit for fixing this:
https://git.zx2c4.com/linux/commit/?id=75ff39ccc1bd5d3c455b6...
Re: A TCP weakness in Linux systems allows network traffic hijack
#10I've found this on isssource and am surprised that it has not spread like wildfire. If the claims are true then this is an issue that should be taken seriously. Posting here for discussion.
The vulnerability claim is very interesting.
The ISS Source article itself is garbage.
They do not explain the origin of the attack, instead simply mention "a subtle flaw (in the form of 'side channels')" [sic]. They do not explain why their "temporary patch" [sic] of raising the challenge ack limit makes the vuln "practically impossible to exploit".
Hell, they do not even link to the original paper.