2

By exploiting CVE-2016-5696, it's possible for an attacker to infer the existence of a TCP connection between two devices, to disrupt that connection and to inject arbitrary data into the TCP stream, without needing to be in the network path between the two devices.

From reading the articles about this, it's clear only certain systems are going to be vulnerable; generally those with Linux kernel versions greater than 3.6, or where the relevant kernel patches have been back-applied.

Given a TCP connection between a client and a server, it's not clear which of these needs to have the vulnerable kernel for the connection to be potentially vulnerable. Is it sufficient for either end to be running vulnerable code, or is the attack only possible if both ends have the vulnerability?

Improve this question

1 Answer 1

Reset to default
3

The attack is using a specific implementation of RFC 5961 on the server as an oracle to find out which connection (ports) from a specific client exist and what are the current sequence numbers. This means it is enough that the problematic implementation exists on the server.

Improve this answer
2
  • To be clear, then: if the TCP client is running affected code, but the server isn't, the connection between the two is not vulnerable?
    – me_and
    Sep 16, 2016 at 15:28
  • @me_and: the attacks needs valid connections from the attacker to one of the parties for reference. Thus it needs to connect to the server and not the client, i.e. to the one which accepts incoming connections.
    – Steffen Ullrich
    Sep 16, 2016 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.