Executive brief
A flaw in how certain operating systems manage network connections allows for predictable port assignment. This predictability can be exploited by attackers to impersonate trusted systems or intercept data, potentially leading to unauthorized access or the manipulation of network traffic. Organizations using legacy systems with this behavior are at risk of spoofing attacks that bypass standard network trust assumptions.
Technical details
The vulnerability stems from the sequential allocation of TCP ports for listening services, rather than using a randomized or non-predictable selection process. An unauthenticated remote attacker can predict the next available port number to facilitate connection hijacking or IP spoofing attacks. By anticipating the port used for a specific service, an attacker can inject malicious packets or intercept communication between two legitimate endpoints. This issue is characteristic of early TCP/IP stack implementations in various operating systems. Mitigation typically involves upgrading the operating system kernel to a version that implements ephemeral port randomization.
Affected products
- Linux linux_kernel
- freebsd freebsd
- netbsd netbsd
- Microsoft windows_nt
Timeline
- 1997-07-01: disclosed