CA-97.28
Published: 1997-12-16 00:00:00
Updated: 1998-05-26 00:00:00
IP Denial-of-Service Attacks
The CERT Coordination Center has received reports of two attack tools (Teardrop and Land) that are
being used to exploit two vulnerabilities in the TCP/IP protocol. Both tools enable a remote user to
cause a denial of service.
The CERT/CC team recommends installing patches from your vendor. Until you are able to do so, we
urge you to use the workaround described in Section III.B. to reduce the likelihood of a successful
attack using Land. There is no workaround for Teardrop.
We will update this advisory as we receive additional information. Please check our advisory files
regularly for updates that relate to your site.
I. Description
In recent weeks there has been discussion on public mailing lists about two denial-of-service attack
tools, Teardrop and Land. These attack tools have similar effects on some systems (namely, causing
the victim machine to crash), but the tools exploit different vulnerabilities.
The CERT Coordination Center has received several reports of sites being attacked by either one or
both of these tools. It is important to note that it may be necessary for a system administrator to apply
separate patches, if they exist, for each attack tool.
Topic 1 - Teardrop
Some implementations of the TCP/IP IP fragmentation re-assembly code do not properly handle
overlapping IP fragments. Teardrop is a widely available attack tool that exploits this vulnerability.
Topic 2 - Land
Some implementations of TCP/IP are vulnerable to packets that are crafted in a particular way (a SYN
packet in which the source address and port are the same as the destination--i.e., spoofed). Land is a
widely available attack tool that exploits this vulnerability.
II. Impact
Topic 1 - Teardrop
Any remote user can crash a vulnerable machine.
Topic 2 - Land
Any remote user that can send spoofed packets to a host can crash or "hang" that host.
III. Solution
CERT/CC urges you to immediately apply vendor patches if they are available. You may have to apply
different patches for each attack tool.
You may want to use the workaround for Land, so please review both Sections A and B below.
A.Consult your vendor
Appendix A contains information from vendors who provided input for this advisory. We will
update the appendix as we receive more information. If you do not see your vendor's name, the
CERT/CC did not hear from that vendor. Please contact your vendor directly.
It is important to note that you may have to apply different patches for each attack tool.
B.Apply the following workaround (Land only)
A workaround for the Land attack tool is to block IP-spoofed packets. This workaround does not
apply to the Teardrop attack tool because the Teardrop attack does not rely on IP-spoofed
packets.
Attacks like those of the Land tool rely on the use of forged packets, that is, packets where the
attacker deliberately falsifies the origin address. With the current IP protocol technology, it is
impossible to eliminate IP-spoofed packets. However, you can reduce the likelihood of your
site's networks being used to initiate forged packets by filtering outgoing packets that have a
source address different from that of your internal network.
Currently, the best method to reduce the number of IP-spoofed packets exiting your network is
to install filtering on your routers that requires packets leaving your network to have a source
address from your internal network. This type of filter prevents a source IP spoofing attack from
your site by filtering all outgoing packets that contain a source address from a different network.
A detailed description of this type of filtering is available in RFC 2267, "Network Ingress
Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing" by
Paul Ferguson of Cisco Systems, Inc. and Daniel Senie of Blazenet, Inc. We recommend it to
both Internet Service Providers and sites that manage their own routers. The document is
currently available at
ftp://ftp.isi.edu/in-notes/rfc2267.txt
Appendix A - Vendor Information
Below is a list of the vendors who have provided information for this advisory. We will update this
appendix as we receive additional information. If you do not see your vendor's name, the CERT/CC did
not hear from that vendor. Please contact the vendor directly.
Berkeley Software Design, Inc. (BSDI)
No version of BSD/OS is vulnerable to Teardrop.
Patched versions of 2.1 and all 3.0 and 3.1 versions are also not vulnerable to Land.
Caldera Corporation
Topic 1 - Teardrop
Unless patched, Linux 2.0.x kernels prior to 2.0.32 are vulnerable. With the application of the kernel
update described in Caldera Security Advisory SA-1997.29 (dated 3-Dec-1997), Caldera OpenLinux is
not vulnerable. This Caldera advisory describes how to obtain and install the update and can be found
at:
http://www.caldera.com/tech-ref/security/SA-1997.29.html
Other Caldera Security Advisories can be found at:
http://www.caldera.com/tech-ref/security/
Topic 2 - Land
There are no known reports of any version of the Linux kernel, including those shipping with Caldera
OpenLinux, being vulnerable to this exploit.
Cisco Systems
Topic 1 - Teardrop
Not vulnerable.
Topic 2 - Land
IOS/7000 software, Catalyst 5xxx and 29xx LAN switches, BPX and IGX WAN switches and AXIS
shelf appear to be vulnerable. PIX firewall and Centri firewall are not vulnerable.
For more information reference URL:
http://www.cisco.com/warp/public/770/land-pub.shtml
Digital Equipment Corporation
This reported problem is not present for Digital's ULTRIX or Digital UNIX Operating Systems Software.
The FreeBSD Project
Topic 1 - Teardrop
CSRG 4.4 is not vulnerable.
Topic 2 - Land
No feedback.
Hewlett-Packard Corporation
HPSBUX9801-076
SECURITY BULLETIN: #00076, 21 January 1998
Description: Security Vulnerability with land on HP-UX
The problem can be fixed by applying the appropriate cumulative ARPA Transport patch mentioned
below.
HP-UX release 11.00 HP9000 Series 700/800 PHNE_14017
HP-UX release 10.30 HP9000 Series 700/800 PHNE_13671
HP-UX release 10.20 HP9000 Series 800 PHNE_13468
HP-UX release 10.24 HP9000 Series 700 PHNE_13888
HP-UX release 10.24 HP9000 Series 800 PHNE_13889
HP-UX release 10.20 HP9000 Series 800 PHNE_13468
HP-UX release 10.20 HP9000 Series 700 PHNE_13469
HP-UX release 10.16 HP9000 Series 700 PHKL_14242
HP-UX release 10.16 HP9000 Series 800 PHKL_14243
HP-UX release 10.10 HP9000 Series 800 PHNE_13470
HP-UX release 10.10 HP9000 Series 700 PHNE_13471
HP-UX release 10.01 HP9000 Series 800 PHNE_13472
HP-UX release 10.01 HP9000 Series 700 PHNE_13473
HP-UX release 10.00 HP9000 Series 800 PHNE_13474
HP-UX release 10.00 HP9000 Series 700 PHNE_13475
HP-UX release 9.04 HP9000 Series 800 PHNE_13476
HP-UX release 9.0[3,5,7] HP9000 Series 700 PHNE_13477
HP-UX release 9.01 HP9000 Series 700 PHNE_13478
HP-UX release 9.00 HP9000 Series 800 PHNE_13479
IBM Corporation
Topic 1 - Teardrop
AIX is not vulnerable.
Topic 2 - Land
AIX is not vulnerable.
Microsoft Corporation
Topic 1 - Teardrop
Windows NT 4.0 with SP 3 and post SP 3 fixes applied and Windows 95 with the appropriate patch
are not vulnerable.
Patch information is available at URL:
ftp://ftp.microsoft.com/bussys/winnt/kb/Q154/1/74.TXT
Topic 2 - Land
Windows NT 4.0 with the appropriate patch is not vulnerable.
Patch information is available at URL:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/land-fix/Q165005.txt
Windows 95 without the WinSock 2.0 Update is not vulnerable.
Patch information is available at URL:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/land-fix/Q177539.TXT
NCR Corporation
Topic 1 - Teardrop
NCR MP-RAS TCP/IP implementation is not vulnerable.
Topic 2 - Land
Apply a patch for your MP-RAS UNIX TCP/IP depending on the revision of the inet package installed
on your system. To check its version execute:
pkginfo -x inet
For inet 5.01.xx.xx: - PINET501 (Version later than 05.01.01.08)
For inet 6.01.xx.xx. - Not vulnerable.
For inet 6.02.xx.xx. - Not vulnerable.
The NetBSD Project
Topic 1 - Teardrop
Versions 1.2 and above are not vulnerable.
Topic 2 - Land
Versions prior to 1.3_BETA will hang. 1.3_BETA and later versions are not vulnerable.
Red Hat Software
Topic 1 - Teardrop
Linux is not vulnerable.
Topic 2 - Land
Linux is not vulnerable.
Sun Microsystems, Inc.
Topic 1 - Teardrop
All releases of Solaris are not vulnerable. All supported versions of SunOS 4.1.x (4.1.3_U1 and 4.1.4)
are not vulnerable.
Topic 2 - Land
All releases of Solaris are not vulnerable. SunOS 4.1.3_U1 and 4.1.4
are vulnerable. The following patches should be installed:
SunOS version Patch Id
------------- --------
4.1.4 102517-05
4.1.3_U1 102010-06
Sun recommended and security patches (including checksums) are available from:
http://sunsolve.sun.com/sunsolve/pubpatches/patches.html
The CERT Coordination Center thanks Paul Ferguson and Daniel Senie for providing information on
network ingress filtering.
If you believe that your system has been compromised, contact the CERT Coordination Center or your
representative in the Forum of Incident Response and Security Teams (see
http://www.first.org/team-info/)
CERT/CC Contact Information
Email cert@cert.org
Phone +1 412-268-7090 (24-hour hotline)
CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4) and are on call for emergencies
during other hours.
Fax +1 412-268-6989
Postal address:
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
USA
Using encryption
We strongly urge you to encrypt sensitive information sent by email. We can support a shared DES
key or PGP. Contact the CERT/CC for more information.
Location of CERT PGP key
ftp://ftp.cert.org/pub/CERT_PGP.key
Getting security information
CERT publications and other security information are available from
http://www.cert.org/
ftp://ftp.cert.org/pub/
CERT advisories and bulletins are also posted on the USENET newsgroup comp.security.announce
To be added to our mailing list for advisories and bulletins, send email to
cert-advisory-request@cert.org
In the subject line, type
SUBSCRIBE your-email-address
Copyright 1997, 1998 Carnegie Mellon University. Conditions for use, disclaimers, and sponsorhsip
information can be found in http://www.cert.org/legal_stuff/legal_stuff.html and
ftp://ftp.cert.org/pub/legal_stuff. If you do not have FTP or web access, send mail to cert@cert.org with
"copyright" in the subject line.
CERT is registered in the U.S. Patent and Trademark Office.
Revision history
May 26, 1998 Updated vendor information for Sun Microsystems, Inc.
Apr. 28, 1998 Corrected URL for obtaining RFCs.
Mar. 10, 1998 Updated vendor information for Hewlett-Packard.
Jan. 29, 1998 Updated reference to the filtering document (now an RFC) in Section III.B.
Jan. 22, 1998 Updated vendor information for Hewlett-Packard.
Jan. 15, 1998 Updated vendor information for Cisco Systems (Teardrop topic).
Jan. 5, 1998 Updated vendor information for NetBSD.
Dec. 17, 1997 Added or updated vendor information for Caldera, NCR,
BSDI, and Sun.
Dec. 16, 1997 Added vendor information for Digital Equipment
