Subject: NEW!! Internet Area Mailing List

From: Margaret Wasserman <[email-masked]>
Date: Wed, 6 Jul 2005 23:41:45 -0400

[This message is bcc:ed to all INT area WGs, the IESG and the IAB.]

Hi All,

We have created an Internet Area mailing list -- [email-masked]. 
This list will be used to announce Internet area BOFs, to discuss 
Internet area WG charter updates and to discuss other issues related 
to the Internet Area, as they arise -- such as whether we should hold 
an Internet area meeting in Paris.

If you wish to join the list, you can do so at:

https://www1.ietf.org/mailman/listinfo/int-area

The archives should be available at:

http://www.ietf.org/mail-archive/web/int-area/index.html

(Hopefully this will be the first message in the archive).

If you are interested in issues concerning the overall structure or 
scope of the Internet area and/or are interested in influencing how 
the Internet area is managed, I hope you will join this list.

Thanks,
Margaret

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: "James Kempf" <[email-masked]>
Date: Thu, 7 Jul 2005 09:46:09 -0700

A friend sent me this reference. I have not looked into this in detail, so
this may be a well-known problem:

http://kerneltrap.org/node/5382

Any comments?

            jak

---

From: Bob Hinden <[email-masked]>
Date: Thu, 07 Jul 2005 09:58:31 -0700

James,

>http://kerneltrap.org/node/5382

There is a thread on /. about this today as well.  I think most of this is 
old news.  The new ICMPv6 update that is being worked on has a major 
revision to the Security Considerations section that should cover these 
issues.  If I remember correctly, the work in V6OPS that the article refers 
to was fed into the new ICMPv6 draft.

Bob

---

From: Fernando Gont <[email-masked]>
Date: Thu, 07 Jul 2005 16:18:59 -0300

At 01:58 p.m. 07/07/2005, Bob Hinden wrote:

>old news.

The attacks are not new, and that's acknowledged in the draft. However, 
there were not counter-measures for them.
Have a look at the NISCC and CERT/CC vulnerability reports, and see the 
number of implementations affected.

>The new ICMPv6 update that is being worked on has a major revision to the 
>Security Considerations section that should cover these issues.

Yes. We discussed this some time ago, and Mukesh has already addressed 
these issues in the ICMPv6 update.

>If I remember correctly, the work in V6OPS that the article refers to was 
>fed into the new ICMPv6 draft.

I don't think so. However, the current ICMPv6 update defines the semantics 
of ICMPv6 error messages, and thus allows anything that runs over IPv6 to 
handle ICMP error messages in what they think is the best way. Thus 
allowing the "TCP's reaction to soft errors" thing to be implemented 
without violating the specs (as is the case with IPv4), for example.

The IPv6-related stuff will be updated in the next revision of my draft, 
which should be ready in the next few days. If you consider it appropriate, 
I can announce the draft on this list, too, so that we can discuss the 
v6-specific stuff.

Kindest regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]

---

From: Fernando Gont <[email-masked]>
Date: Mon, 11 Jul 2005 18:05:11 -0300

At 01:58 p.m. 07/07/2005, Bob Hinden wrote:

>issues.  If I remember correctly, the work in V6OPS that the article 
>refers to was fed into the new ICMPv6 draft.

As far as I understand, PMTUD is mandatory for IPv6. The current 
specifications make it quite trivial to attack it.

Think about an attacker exploiting these vulnerabilities to attack a BGP 
router.

While these problems have been known, the existing specifications don't 
recommend any validation checks on the received ICMP error messages.

Checking the TCP SEQ number does its job. However, it puts you in the same 
position as for the "Slipping in the window" attacks raised last year. The 
more complete PMTUD fix described in 
http://www.gont.com.ar/draft/draft-gont-tcpm-icmp-attacks-03.txt protects 
you from attack, regardless of whether the attacker is able to hit you "in 
the window" or not.

The news with this work is not the vulnerabilities, but the fixes, and the 
raise of awareness in the community.

Have a look at NISCC's and CERT/CC's vulnerability reports, and see the 
large number of systems affected.

Kindest regards,