Subject: [Tsvwg] SCTP Vulnerability

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Mon, 19 Mar 2001 15:45:01 -0600

Have you seen this one yet?

Problem:

    An SCTP endpoint which implements the "SHOULD" parts of RFC 2960
    Section 8.4 or the MUST parts of Section 5.1 can be made to send
    ABORT chunks to an arbitrary address with arbitrary verification
    tags.

Description:

    Section 8.4:

    Evil endpoint 'E' sends an OOTB packet to 'A' spoofing source
    address of the Target 'T'.  If endpoint 'A' sends ABORT to
    OOTB as it SHOULD from Section 8.4, it will send ABORT to
    'T' with T-bit set and VTAG from attacker's message.

    +------+     SRC:T      +------+     DST:T      +------+
    |      |     DST:A      |      |     SRC:A      |      |
    |  E   |--------------->|  A   |--------------->|  T   |
    |      |     VTAG:Z     |      |     VTAG:Z     |      |
    +------+                +------+     T-Bit      +------+

                HEARTBEAT                ABORT

    The target 'T' is vulnerable (and 'A' gullable) in the COOKIE-WAIT
    and COOKIE-ECHOED states on the selected port.  By flooding, 'E'
    could possibly deny initialization of associations from 'T' to 'A's
    well-known port numbers.

    Solution: Don't send ABORT in response to OOTB as indicated
    in RFC 2960 Section 8.4.

    Section 5.1:

    Evil endpoint 'E' sends an OOTB INIT to 'A' with missing or
    invalid mandatory parameters spoofing source address of the
    Target 'T'.  If endpoint 'A' sends ABORT to OOTB INIT as
    it MUST in Section 5.1, it will send ABORT to 'T', without
    T-bit set and with the VTAG from the attacker's INIT ITAG.

    +------+     SRC:T      +------+     DST:T      +------+
    |      |     DST:A      |      |     SRC:A      |      |
    |  E   |--------------->|  A   |--------------->|  T   |
    |      |     VTAG:0     |      |     VTAG:Z     |      |
    +------+     ITAG:Z     +------+                +------+

             Bad INIT                    ABORT

    The target 'T' is vulnerable (and 'A' gullable) in the COOKIE-WAIT
    and COOKIE-ECHOED states on the selected port.  By flooding, 'E'
    could possibly deny initialization of associations from 'T' to 'A's
    well-known port numbers.

    Solution: Don't send ABORT in response to refused INIT in
    violation of RFC 2960 Section 5.1.

Solution:

    Do not, or throttle, sending ABORT to OOTB packets.

-- 
Brian F. G. Bidulock    ¦ The reasonable man adapts himself to the ¦
[email-masked]    ¦ world; the unreasonable one persists in  ¦
http://www.openss7.org/ ¦ trying  to adapt the  world  to himself. ¦
                        ¦ Therefore  all  progress  depends on the ¦
                        ¦ unreasonable man. -- George Bernard Shaw ¦

_______________________________________________
tsvwg mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/tsvwg