Detections
Analytics
TCP/IP Initial Sequence Number (ISN) Reuse Weakness
high Nessus Plugin ID 11057
Synopsis
The remote device seems to generate predictable TCP Initial Sequence Numbers.Description
The remote host seems to generate Initial Sequence Numbers (ISN) in a weak manner which seems to solely depend on the source and dest port of the TCP packets.An attacker may exploit this flaw to establish spoofed connections to the remote host.
The Raptor Firewall and Novell NetWare are known to be vulnerable to this flaw, although other network devices may be vulnerable as well.
Solution
If you are using a Raptor Firewall, install the TCP security hotfix described in Symantec's advisory. Otherwise, contact your vendor for a patch.See Also
Plugin Details
Severity: High
ID: 11057
File Name: raptor_isn.nasl
Version: 1.39
Type: remote
Family: General
Published: 8/2/2002
Updated: 11/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.2
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2002-1463
CVSS v3
Risk Factor: High
Base Score: 7.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Vulnerability Information
Required KB Items: Settings/ThoroughTests
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 1/1/1995
Reference Information
CVE: CVE-2002-1463