Executive brief
A vulnerability in the way network communications are handled allows an attacker to remotely disconnect active internet connections. By sending specially crafted network messages, an attacker can trick a computer into believing a destination is unreachable, effectively cutting off communication. This can lead to a total loss of service for critical applications and business operations.
Technical details
The vulnerability exists in the handling of ICMP 'Destination Unreachable' messages within the TCP/IP stack. An attacker can craft and send forged ICMP unreachable packets to a target host, spoofing the source address of an active connection. Because many early network implementations did not properly validate these ICMP messages against the state of active TCP connections, the host would immediately terminate the session. This allows a remote, unauthenticated attacker to perform a denial of service (DoS) attack against any reachable network service.
Affected products
- Generic TCP/IP Stack
Timeline
- 1992-07-21: disclosed