Section 5.5 Defeating TCP Sequence Spoofing | Real World Linux Security Prentice Hall Ptr Open Source Technology Series

5.5 Defeating TCP Sequence Spoofing

graphics/twodangerlevel.gif

Older Linux kernels (and many other operating systems) use a predictable sequence numbering of TCP packets that opens a vulnerability for a cracker spoofing packets and taking over a connection. See "TCP Sequence Spoofing Explained" on page 243 for a detailed explanation. The solution is to upgrade your Linux kernel to one that has a hard-to-spoof sequencing. This hard-to-spoof sequence has been in the Linux kernel at least as far back as 2.0.30.

However, there is a bug in the TCP stack of older kernels that still allowed TCP spoofing via a different method because a client (using a fake source address) could send packets that would be delivered to the listening server before the three-way TCP open was completed. Because the rogue client did not have to wait for the three-way TCP open to complete, it did not have to receive the SYN/ACK packet and thus defeated TCP security. This latter bug was fixed in the 2.0.36 kernel so if your kernel is older than this, do upgrade soon to be protected against TCP spoofing.

Top