Re: [tcpm] Is this a problem?

[Florian Weimer <[e-mail]>]

* Mahesh Jethanandani:

> Three well-known, public sites were tested for this vulnerability. The
> two most common HTTP servers, Apache and IIS were the target. While
> one site had put mitigation technique in place, the others had
> none. With the latter two we were able to hold connections in
> ESTABLISHED state for days. The former site had a mitigation in place
> with a fixed timeout of 11 min., which was easy to guess and work
> around.
>
> We (the authors) believe that this is a huge problem. What do you
> folks feel?

It's a problem, but not at the TCP layer.

SSH connections, for instance, can legitimately last for days in
ESTABLISHED state without any traffic being exchanged.

For HTTP, it may be helpful to have some kind of information regarding
the TCP state to mitigate the DoS potential, but I fear that it's too
easily manipulated by the attacker to be useful.  Even if it's not, it's
really a sockets API issue.


_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm