Executive brief
A vulnerability in network stack configurations allows systems to process UDP messages sent to broadcast addresses. This can be exploited to launch a 'Fraggle' denial-of-service attack, where a flood of network traffic overwhelms a target system or network segment. Successful exploitation can lead to significant network congestion and temporary loss of service availability for legitimate users.
Technical details
The vulnerability arises from network configurations or operating system kernels that permit the processing of UDP packets directed at broadcast addresses. An attacker can exploit this by sending spoofed UDP packets (often targeting services like Echo or Chargen) to a broadcast address, with the source address set to the victim's IP. This results in a 'Fraggle' attack, where all devices on the broadcast domain respond to the victim simultaneously, causing a massive amplification of traffic. This leads to a denial-of-service (DoS) condition due to bandwidth exhaustion or resource depletion on the target host. Mitigation typically involves configuring routers and hosts to ignore directed broadcast traffic.
Timeline
- 1998-03-01: disclosed: Initial publication date in NVD.