Subject: RE: IESG Comments about ICMPv6 draft: Authentication and Confidentiality of ICMP messages

From: Fernando Gont <[email-masked]>
Date: Mon, 14 Mar 2005 02:02:52 -0300

At 03:13 27/02/2005 -0600, [email-masked] wrote:

> > By the way, one additional ICMP attack that could possibly be
> > included
> > in 5.2:
> >
> >     6. As the ICMP messages are passed to the upper-layer
> > processes, it
> >        is possible to perform attacks on the upper layer protocols
> >        (e.g., TCP) with ICMP [TCP-attack].  Protecting the upper layer
> >        with IPsec mitigates this problem, though the upper layers may
> >        also perform some form of validation of ICMPs on their own.
> >
> > Where [TCP-attack] is an informative reference to
> > draft-gont-tcpm-icmp-attacks-03.txt.
>
>Interesting.  I will try to add this to the next rev.

Note that if a host does not implement IPsec, blindly processing ICMP 
messages is probably not a good idea. For TCP, for example, you can check 
both the TCP SEQ and the ACK a numbers. These checks (probably together 
with port randomization) mean that (pratically) only on-path attackers can 
perform ICMP-based attacks against TCP.

All these checks are described in draft-gont-tcpm-icmp-attacks-03.txt, as 
pointed out by Pekka.

Kindest regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------