Security Advisory ZPE-NG-2023-002

Security Advisory ZPE-NG-2023-003

Advisory ID: ZPE-NG-2023-003
First Published: January 02, 2024
CVE ID: CVE-2004-0230
CVSSv2 Score: 5.0 (Medium)

Summary

TCP connections with large window size may be susceptible to be disconnected by repeatedly injecting TCP reset packets, especially in protocols that use long-lived connections such as BGP.

Affected Products

All Nodegrid OS versions.

Nodegrid OS is used in the following products:
  1. Nodegrid Serial Console
  2. Nodegrid Serial Console Plus
  3. Nodegrid Net Services Router
  4. Nodegrid Gate SR
  5. Nodegrid Link SR
  6. Nodegrid Bold SR
  7. Nodegrid Hive SR
  8. Nodegrid Mini SR
  9. Nodegrid Manager
  10. Nodegrid Virtual Services Router

Impact

A connection may be disconnected, especially in protocols that use long-lived connections such as BGP.

This is a disputed vulnerability, one which several vendors using the Linux kernel such as Red Hat argued that it does not warrant a fix.

It is important to notice this relies on a feature of the TCP specification, RFC 793.

Mitigation

Qualys reports this as QID 82054.


Adding this in /etc/sysctl.conf will avoid detection by Qualys:

  1. net.ipv4.tcp_window_scaling = 0
  2. net.ipv4.tcp_syncookies = 1
  3. net.ipv4.tcp_max_syn_backlog = 2048
  4. net.ipv4.tcp_synack_retries = 3
After this change is done, execute:
  1. /sbin/sysctl -p /etc/sysctl.conf
However, we do not recommend this as the vulnerability is not severe, is disputed by the community, and these changes may cause adverse effects.

The Linux kernel already implements the mitigation proposed in RFC 5961 section 3.2 since version 3.2.37, which includes all Nodegrid versions.

IPSec tunnels and similar tunnels do provide protection against this attack.

TCP MD5 Signature Option as defined in RFC 2385 also provides protection against this attack.

Solutions

There are no comprehensive solutions, and there are no plans to implement one.

Timeline

2004-04-23: Paul Watson presented an analysis of the vulnerability at CanSecWest.