Executive brief
A vulnerability in how certain operating systems handle network messages allows for a "Smurf" denial-of-service attack. By sending specially crafted network traffic to a broadcast address, an attacker can cause a network to become congested with traffic, potentially crashing systems or making services unavailable to legitimate users. This impacts the availability of corporate network resources and can disrupt business operations.
Technical details
The operating system's IP stack incorrectly responds to ICMP Echo Request (ping) messages sent to a broadcast address. An attacker can spoof the source IP address of these requests to be that of a target victim. When the network's hosts receive the broadcast request, they all respond simultaneously to the victim's IP address, leading to a distributed denial-of-service (DDoS) condition known as a Smurf attack. This is a network-based attack requiring no authentication. Mitigation typically involves configuring the OS or network routers to ignore directed broadcasts and ICMP requests to broadcast addresses.
Affected products
- Sun Solaris 2.4, 2.5, 2.5.1, 2.6
- Sun SunOS 5.4, 5.5, 5.5.1
Timeline
- 1998-01-05: disclosed