TCP/BGP vulnerability - easier than you think

Wed Apr 21 11:27:42 UTC 2004

On Wed, Apr 21, 2004 at 01:23:54PM +0200, Iljitsch van Beijnum wrote:
> 
> On Wed, 21 Apr 2004, Daniel Roesen wrote:
> 
> > > access-list 123 deny   tcp any any eq bgp rst log-input
> > > access-list 123 deny   tcp any eq bgp any rst log-input
> 
> > > Unfortunately, not all vendors are able to look at the RST bit when
> > > filtering...
> 
> > The general ignorance to the fact that SYN works as well is
> > astonishing. :-)
> 
> What are you talking about?

http://www.uniras.gov.uk/vuls/2004/236929/index.htm

First paragraph of the summary:

"The issue described in this advisory is the practicability of resetting
an established TCP connection by sending suitable TCP packets with the
RST (Reset) or SYN (Synchronise) flags set."

You can break TCP sessions not only be injecting harmfully crafted
RST packets, but also with SYN packets.

All talk I see going on is always about harmful RST packets only. Seems
like noone realized that the thread is equally intense with SYN packets.