Executive brief
A fundamental flaw in how network connections are established allows remote attackers to crash or freeze internet-connected systems. By flooding a server with incomplete connection requests, an attacker can exhaust the system's resources, making it unavailable to legitimate users. This can lead to significant downtime for web servers and other critical infrastructure.
Technical details
This vulnerability is a classic TCP SYN flood attack targeting the three-way handshake process. An attacker sends a high volume of SYN packets from spoofed or unreachable IP addresses, forcing the victim system to allocate resources in the 'SYN_RECV' state for connections that will never be completed. This exhausts the system's connection queue (backlog), preventing legitimate users from establishing new TCP connections. The attack is network-based, requires no authentication, and results in a complete denial of service for network-facing applications. Modern mitigations like SYN cookies were developed to address this class of vulnerability.
Affected products
- Sun Microsystems Solaris
- SGI IRIX
Timeline
- 1996-09-19: disclosed
- 1996-12-02: advisory: SGI security advisory released