AUSCERT External Security Bulletin Redistribution

                     ESB-97.162 -- CERT Advisory CA-97.28
                         IP Denial-of-Service Attacks

                              17 December 1997


CERT/CC has released the following advisory describing two different
attacks against the TCP/IP protocol.  Attack tools have been developed,
and distributed publicly, which enable remote users to exploit these
vulnerabilities to cause a Denial of Service (DoS) attack.

The following security bulletin is provided as a service to AUSCERT's
members.  As AUSCERT did not write this document, AUSCERT has had no
control over its content.  As such, the decision to use any or all of this
information is the responsibility of each user or organisation, and should
be done so in accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It will
not be updated when the original bulletin is.  If downloading at a later
date, it is recommended that the bulletin is retrieved from the original
authors to ensure that the information is still current.

Contact information for CERT/CC is included in the Security Bulletin
below.  If you have any questions or need further information, please
contact them directly. 

Previous advisories and external security bulletins can be retrieved from:


If you believe that your system has been compromised, contact AUSCERT or your
representative in FIRST (Forum of Incident Response and Security Teams).

Internet Email: auscert@auscert.org.au
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AUSCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for emergencies.
Facsimile:      (07) 3365 7031

- --------------------------BEGIN INCLUDED TEXT--------------------


CERT* Advisory CA-97.28
Original issue date: Dec. 16, 1997
Last revised: --

Topic:  IP Denial-of-Service Attacks
- - -----------------------------------------------------------------------------

The CERT Coordination Center has received reports of two attack tools
(Teardrop and Land) that are being used to exploit two vulnerabilities in the
TCP/IP protocol. Both tools enable a remote user to cause a denial of service.

The CERT/CC team recommends installing patches from your vendor. Until you are
able to do so, we urge you to use the workaround described in Section
III.B. to reduce the likelihood of a successful attack using Land. There is
no workaround for Teardrop.

We will update this advisory as we receive additional information.
Please check our advisory files regularly for updates that relate to your

- - -----------------------------------------------------------------------------

I. Description

     In recent weeks there has been discussion on public mailing lists about
     two denial-of-service attack tools, Teardrop and Land. These attack tools
     have similar effects on some systems (namely, causing the victim machine
     to crash), but the tools exploit different vulnerabilities.

     The CERT Coordination Center has received several reports of sites being
     attacked by either one or both of these tools. It is important to note
     that it may be necessary for a system administrator to apply separate
     patches, if they exist, for each attack tool.

     Topic 1 - Teardrop

     Some implementations of the TCP/IP IP fragmentation re-assembly code do
     not properly handle overlapping IP fragments. Teardrop is a widely
     available attack tool that exploits this vulnerability.

     Topic 2 - Land

     Some implementations of TCP/IP are vulnerable to packets that are crafted
     in a particular way (a SYN packet in which the source address and port
     are the same as the destination--i.e., spoofed). Land is a widely
     available attack tool that exploits this vulnerability.

II.  Impact

     Topic 1 - Teardrop

     Any remote user can crash a vulnerable machine.

     Topic 2 - Land

     Any remote user that can send spoofed packets to a host can crash or
     "hang" that host.

III. Solution

     CERT/CC urges you to immediately apply vendor patches if they are
     available. You may have to apply different patches for each attack tool.

     You may want to use the workaround for Land, so please review
     both Sections A and B below.

    A. Consult your vendor

       Appendix A contains information from vendors who provided input for
       this advisory. We will update the appendix as we receive more
       information. If you do not see your vendor's name, the CERT/CC did not
       hear from that vendor. Please contact your vendor directly.

       It is important to note that you may have to apply different
       patches for each attack tool.

    B. Apply the following workaround (Land only)

       A workaround for the Land attack tool is to block IP-spoofed packets.
       This workaround does not apply to the Teardrop attack tool because the
       Teardrop attack does not rely on IP-spoofed packets.

       Attacks like those of the Land tool rely on the use of forged packets,
       that is, packets where the attacker deliberately falsifies the origin
       address. With the current IP protocol technology, it is impossible to
       eliminate IP-spoofed packets. However, you can reduce the likelihood of
       your site's networks being used to initiate forged packets by filtering
       outgoing packets that have a source address different from that of your
       internal network.

       Currently, the best method to reduce the number of IP-spoofed packets
       exiting your network is to install filtering on your routers that
       requires packets leaving your network to have a source address from
       your internal network. This type of filter prevents a source IP
       spoofing attack from your site by filtering all outgoing packets that
       contain a source address from a different network.

       A detailed description of this type of filtering is available in the
       Internet Draft "Network Ingress Filtering: Defeating Denial of Service
       Attacks which employ IP Source Address Spoofing" by Paul Ferguson of
       Cisco Systems, Inc. and Daniel Senie of Blazenet, Inc. Note that
       although this document is labeled as an IETF "working draft," the
       content is complete and it is being proposed as an Informational RFC.
       We recommend it to both Internet Service Providers and sites that
       manage their own routers.

       The document is currently available at



Appendix A - Vendor Information

Below is a list of the vendors who have provided information for this
advisory. We will update this appendix as we receive additional information.
If you do not see your vendor's name, the CERT/CC did not hear from that
vendor. Please contact the vendor directly.

Cisco Systems

Topic 1 - Teardrop

No feedback.

Topic 2 - Land

IOS/7000 software, Catalyst 5xxx and 29xx LAN switches, BPX and IGX WAN
switches and AXIS shelf appear to be vulnerable.
PIX firewall and Centri firewall are not vulnerable.

For more information reference URL:

Digital Equipment Corporation

Topic 1 - Teardrop

No feedback.

Topic 2 - Land

ULTRIX is not vulnerable.

The FreeBSD Project

Topic 1 - Teardrop

CSRG 4.4 is not vulnerable.

Topic 2 - Land

No feedback.

Hewlett-Packard Corporation

Topic 1 - Teardrop

HP-UX versions 9.04-10.20 are not vulnerable.

Topic 2 - Land

No feedback.

IBM Corporation

Topic 1 - Teardrop

AIX is not vulnerable.

Topic 2 - Land

AIX is not vulnerable.

Microsoft Corporation

Topic 1 - Teardrop

Windows NT 4.0 with SP 3 and post SP 3 fixes applied and Windows 95
with the appropriate patch are not vulnerable.
Patch information is available at URL:

Topic 2 - Land

Windows NT 4.0 with the appropriate patch is not vulnerable.
Patch information is available at URL:

Windows 95 without the WinSock 2.0 Update is not vulnerable.
Patch information is available at URL:

NCR Corporation

Topic 1 - Teardrop

NCR TCP/IP implementation is not vulnerable.

Topic 2 - Land

No feedback.

The NetBSD Project

Topic 1 - Teardrop

Versions 1.2 and above are not vulnerable.

Topic 2 - Land

No feedback.

Red Hat Software

Topic 1 - Teardrop

Linux is not vulnerable.

Topic 2 - Land

Linux is not vulnerable.

- - ---------------------------------------------------------------------------

The CERT Coordination Center thanks Paul Ferguson and Daniel Senie for
providing information on network ingress filtering.

- - ----------------------------------------------------------------------------

If you believe that your system has been compromised, contact the CERT
Coordination Center or your representative in the Forum of Incident Response
and Security Teams (see http://www.first.org/team-info/).

CERT/CC Contact Information
- - ----------------------------
Email    cert@cert.org

Phone    +1 412-268-7090 (24-hour hotline)
                CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4)
                and are on call for emergencies during other hours.

Fax      +1 412-268-6989

Postal address
         CERT Coordination Center
         Software Engineering Institute
         Carnegie Mellon University
         Pittsburgh PA 15213-3890

Using encryption
   We strongly urge you to encrypt sensitive information sent by email. We
   can  support a shared DES key or PGP. Contact the CERT/CC for more

   Location of CERT PGP key

Getting security information
   CERT publications and other security information are available from

   CERT advisories and bulletins are also posted on the USENET newsgroup

   To be added to our mailing list for advisories and bulletins, send
   email to
   In the subject line, type
	SUBSCRIBE  your-email-address

- - ---------------------------------------------------------------------------

Copyright 1997 Carnegie Mellon University. Conditions for use, disclaimers,
and sponsorship information can be found in
http://www.cert.org/legal_stuff.html and ftp://ftp.cert.org/pub/legal_stuff .
If you do not have FTP or web access, send mail to cert@cert.org with
"copyright" in the subject line.

*CERT is registered in the U.S. Patent and Trademark Office.

- - ---------------------------------------------------------------------------

This file: ftp://ftp.cert.org/pub/cert_advisories/CA-97.28.Teardrop_Land
               click on "CERT Advisories"

Revision history

Version: 2.6.2


- --------------------------END INCLUDED TEXT--------------------

Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key