The original design of ICMP does not require authentication for host-generated ICMP error messages, which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.

The vulnerability described in this article was initially fixed in earlier versions, but a regression was reintroduced in BIG-IP 12.x through13.x. For information about earlier versions, refer toK4583:
Insufficient validation of ICMP error messages - VU#222750 / CVE-2004-0790(9.x - 10.x).

Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the 'blind connection-reset attack.' NOTE:
CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. (CVE-2004-0790)

Impact

A remote attacker can interfere with the Path MTU Discovery process and cause a performance degradation or reset of FastL4 accelerated TCP connections by spoofing a specifically craftedInternet Control Message Protocol (ICMP) message.

This vulnerability only applies to FastL4 virtual servers on BIG-IP platforms with the embedded Packet Velocity Acceleration (ePVA) chip.The ePVA chip is a hardware acceleration Field Programmable Gate Array (FPGA) that delivers high-performance Layer 4 (L4) IPv4 throughput. ePVA chips are included on the following BIG-IP platforms :

B2100 Blade in the VIPRION C2400 or C2200 Chassis

B2150 Blade in the VIPRION C2400 or C2200 Chassis

B2250 Blade in the VIPRION C2400 or C2200 Chassis

B4300 Blade in the VIPRION C4480 or C4800 Chassis

B4340 Blade in the VIPRION C4480 or C4800 Chassis

BIG-IP 12000 series

BIG-IP 10000 series

BIG-IP 7000 series

BIG-IP 5000 series

BIG-IP i5000 series

BIG-IP i7000 series

BIG-IP i10000 series

A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt ).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
Successful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.

The remote host runs a version of Windows that has a flaw in its TCP/IP stack.

The flaw could allow an attacker to execute arbitrary code with SYSTEM privileges on the remote host, or to perform a denial of service attack against the remote host.

Proof of concept code is available to perform a Denial of Service against a vulnerable system.

ID	Name	Product	Family	Severity
100000	F5 Networks BIG-IP : Insufficient validation of ICMP error messages (K23440942)	Nessus	F5 Networks Local Security Checks	critical
48985	Crafted ICMP Messages Can Cause Denial of Service - Cisco Systems	Nessus	CISCO	medium
18023	MS05-019: Vulnerabilities in TCP/IP Could Allow Remote Code Execution (893066)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2005-0068

medium

Tenable Plugins

critical

medium

high