Executive brief
Many operating systems and networking devices are configured by default to respond to certain diagnostic network messages (ICMP). An attacker can use these responses to discover internal network settings and synchronize timing for more complex attacks. While not a direct way to take over a system, this information helps attackers map out a target's infrastructure.
Technical details
The affected systems respond to ICMP Type 13 (Timestamp Request) and ICMP Type 17 (Address Mask Request) messages. A response to Type 17 leaks the subnet mask of the responding interface, assisting in network topology mapping. A response to Type 13 leaks the system clock, which can be used for time-skew correlation, fingerprinting, or predicting sequence numbers in weak cryptographic protocols. This is a configuration-based information disclosure vulnerability (CWE-200). Mitigation typically involves configuring firewalls or host-based security policies to drop these specific ICMP types.
Affected products
- Linux Linux Kernel
- Microsoft Windows
- Apple macOS
- Cisco IOS
- Oracle Solaris
- IBM AIX
- HP HP-UX
Timeline
- 1997-08-01: disclosed: Initial publication date
References
- http://descriptions.securescout.com/tc/11010
- http://descriptions.securescout.com/tc/11011
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&externalId=1434
- http://www.osvdb.org/95
- https://exchange.xforce.ibmcloud.com/vulnerabilities/306
- https://exchange.xforce.ibmcloud.com/vulnerabilities/322