Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.

The vulnerability described in this article was initially fixed in earlier versions, but a regression was reintroduced in BIG-IP 12.x through13.x. For information about earlier versions, refer toK4583:
Insufficient validation of ICMP error messages - VU#222750 / CVE-2004-0790(9.x - 10.x).

Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the 'blind connection-reset attack.' NOTE:
CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. (CVE-2004-0790)

Impact

A remote attacker can interfere with the Path MTU Discovery process and cause a performance degradation or reset of FastL4 accelerated TCP connections by spoofing a specifically craftedInternet Control Message Protocol (ICMP) message.

This vulnerability only applies to FastL4 virtual servers on BIG-IP platforms with the embedded Packet Velocity Acceleration (ePVA) chip.The ePVA chip is a hardware acceleration Field Programmable Gate Array (FPGA) that delivers high-performance Layer 4 (L4) IPv4 throughput. ePVA chips are included on the following BIG-IP platforms :

B2100 Blade in the VIPRION C2400 or C2200 Chassis

B2150 Blade in the VIPRION C2400 or C2200 Chassis

B2250 Blade in the VIPRION C2400 or C2200 Chassis

B4300 Blade in the VIPRION C4480 or C4800 Chassis

B4340 Blade in the VIPRION C4480 or C4800 Chassis

BIG-IP 12000 series

BIG-IP 10000 series

BIG-IP 7000 series

BIG-IP 5000 series

BIG-IP i5000 series

BIG-IP i7000 series

BIG-IP i10000 series

Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ('Fragmentation Needed and Don't Fragment was Set') packets with a low next-hop MTU value, aka the 'Path MTU discovery attack.' (CVE-2004-1060)

A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt ).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
Successful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.

s700_800 11.04 (VVOS) cumulative ARPA Transport patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running TCP/IP. This vulnerability could be     remotely exploited by an unauthorized user to cause a     Denial of Service(DoS). References: NISCC VU#532967,     CAN-2004-0790, CAN-2004-0791, CAN-2004-1060.
    (HPSBUX01164 SSRT4884)

  - A potential security vulnerability has been identified     with HP-UX running TCP/IP. The potential vulnerability     could be exploited remotely to cause a Denial of Service     (DoS). (HPSBUX02087 SSRT4728)

s700_800 11.00 cumulative ARPA Transport patch : 

A potential security vulnerability has been identified with HP-UX running TCP/IP. This vulnerability could be remotely exploited by an unauthorized user to cause a Denial of Service(DoS). References: NISCC VU#532967, CAN-2004-0790, CAN-2004-0791, CAN-2004-1060.

s700_800 11.23 cumulative ARPA Transport patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running TCP/IP. This vulnerability could be     remotely exploited by an unauthorized user to cause a     Denial of Service(DoS). References: NISCC VU#532967,     CAN-2004-0790, CAN-2004-0791, CAN-2004-1060.
    (HPSBUX01164 SSRT4884)

  - A potential security vulnerability has been identified     with HP-UX running TCP/IP (IPv4). This vulnerability     could be remotely exploited to cause a Denial of Service     (DoS). (HPSBUX01137 SSRT5954)

s700_800 11.11 cumulative ARPA Transport patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running TCP/IP (IPv4). This vulnerability     could be remotely exploited to cause a Denial of Service     (DoS). (HPSBUX01137 SSRT5954)

  - A potential security vulnerability has been identified     with HP-UX running TCP/IP. This vulnerability could be     remotely exploited by an unauthorized user to cause a     Denial of Service(DoS). References: NISCC VU#532967,     CAN-2004-0790, CAN-2004-0791, CAN-2004-1060.
    (HPSBUX01164 SSRT4884)

s700_800 11.00 ndd(1M) cumulative patch : 

A potential security vulnerability has been identified with HP-UX running TCP/IP. This vulnerability could be remotely exploited by an unauthorized user to cause a Denial of Service(DoS). References: NISCC VU#532967, CAN-2004-0790, CAN-2004-0791, CAN-2004-1060.

s700_800 11.04 (VVOS) ndd(1M) cumulative patch : 

A potential security vulnerability has been identified with HP-UX running TCP/IP. This vulnerability could be remotely exploited by an unauthorized user to cause a Denial of Service(DoS). References: NISCC VU#532967, CAN-2004-0790, CAN-2004-0791, CAN-2004-1060.

The remote host runs a version of Windows that has a flaw in its TCP/IP stack.

The flaw may allow an attacker to execute arbitrary code with SYSTEM privileges on the remote host or to perform a denial of service attack against the remote host.

Proof of concept code is available to perform a denial of service attack against a vulnerable system.

The remote host runs a version of Windows that has a flaw in its TCP/IP stack.

The flaw could allow an attacker to execute arbitrary code with SYSTEM privileges on the remote host, or to perform a denial of service attack against the remote host.

Proof of concept code is available to perform a Denial of Service against a vulnerable system.

s700_800 11.11 cumulative ARPA Transport patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running TCP/IP. This vulnerability could be     remotely exploited by an unauthorized user to cause a     Denial of Service(DoS). References: NISCC VU#532967,     CAN-2004-0790, CAN-2004-0791, CAN-2004-1060.
    (HPSBUX01164 SSRT4884)

  - An HP-UX 11.11 machine with TRANSPORT patches     PHNE_24211, PHNE_24506, PHNE_25134, or PHNE_25642 may be     exposed to a denial of service through the malicious use     of the 'ndd' command. (HPSBUX00192 SSRT071390)

  - TCP Initial Sequence Number (ISN) randomization     specified in RFC 1948 is available for HP-UX.
    References: CVE-2001-0328, CERT CA-2001-09. (HPSBUX00205     SSRT080009)

ID	Name	Product	Family	Severity
100000	F5 Networks BIG-IP : Insufficient validation of ICMP error messages (K23440942)	Nessus	F5 Networks Local Security Checks	critical
84451	F5 Networks BIG-IP : Path MTU discovery vulnerability (K15792)	Nessus	F5 Networks Local Security Checks	medium
48985	Crafted ICMP Messages Can Cause Denial of Service - Cisco Systems	Nessus	CISCO	medium
19486	HP-UX PHNE_33427 : s700_800 11.04 (VVOS) cumulative ARPA Transport patch	Nessus	HP-UX Local Security Checks	high
19363	HP-UX PHNE_33395 : HP-UX TCP/IP Remote Denial of Service (DoS) (HPSBUX01164 SSRT4884 rev.9)	Nessus	HP-UX Local Security Checks	medium
19362	HP-UX PHNE_32606 : s700_800 11.23 cumulative ARPA Transport patch	Nessus	HP-UX Local Security Checks	medium
18608	HP-UX PHNE_33159 : s700_800 11.11 cumulative ARPA Transport patch	Nessus	HP-UX Local Security Checks	medium
18399	HP-UX PHNE_26125 : HP-UX TCP/IP Remote Denial of Service (DoS) (HPSBUX01164 SSRT4884 rev.9)	Nessus	HP-UX Local Security Checks	medium
18398	HP-UX PHNE_26076 : HP-UX TCP/IP Remote Denial of Service (DoS) (HPSBUX01164 SSRT4884 rev.9)	Nessus	HP-UX Local Security Checks	medium
18028	MS05-019: Vulnerabilities in TCP/IP Could Allow Remote Code Execution (893066) (uncredentialed check)	Nessus	Windows	high
18023	MS05-019: Vulnerabilities in TCP/IP Could Allow Remote Code Execution (893066)	Nessus	Windows : Microsoft Bulletins	high
16508	HP-UX PHNE_25644 : s700_800 11.11 cumulative ARPA Transport patch	Nessus	HP-UX Local Security Checks	medium

Detections

Analytics

CVE-2004-1060

high

Tenable Plugins

critical

medium

medium

high

medium

medium

medium

medium

medium

high

high

medium