Re: Linux zero IP ID vulnerability?
On Wed, Mar 15, 2006 at 10:26:00AM +0100, Marco Ivaldi wrote:
[..]
Not sure i fully understand your comments... Anyway, here's an host
showing the flawed behaviour (Gentoo Linux 2.6.14-gentoo-r5 + grsec):
Well, it may be related to GR security.
SinFP[1] exploits a difference in IP ID generation to detect
(to some extent) the use of GR security inside a Linux kernel.
In fact, last time I checked, there was an option in GRsec
configuration to alter IP ID generation behaviour. You can try
to play with this.
[1] http://www.gomor.org/cgi-bin/index.pl?mode=view;page=net_sinfp
--
^ ___ ___ http://www.GomoR.org/ <-+
| / __ |__/ Systems & Security Engineer |
| \__/ | \ ---[ zsh$ alias psed='perl -pe ' ]--- |
+--> Net::Packet <=> http://search.cpan.org/~gomor/ <--+