Executive brief
A network configuration allows external users to perform traceroute operations against the system. While this is a standard networking function used for troubleshooting, it can allow outsiders to map the internal path of a network. This is generally considered a low-risk information disclosure issue rather than a direct security breach.
Technical details
This is a configuration-based vulnerability where a host or router responds to ICMP Time Exceeded or unreachable messages, or UDP probes, allowing the 'traceroute' utility to function from any source. It is classified as a configuration issue rather than a software flaw. An attacker can use this to discover the hop-by-hop path to a destination and identify internal network topology. Mitigation typically involves configuring firewalls or ACLs to rate-limit or drop ICMP TTL-expired messages and specific UDP port ranges used by traceroute.
Affected products
- Generic IP Stack
Timeline
- 1997-01-01: disclosed