ADV180022 | Windows Denial of Service Vulnerability

Minimalist · Sep 15, 2018

Microsoft is aware of a denial of service vulnerability (named "FragmentSmack" CVE-2018-5391) affecting Windows systems. An attacker could send many 8-byte sized IP fragments with random starting offsets, but withhold the last fragment and exploit the worst-case complexity of linked lists in reassembling IP fragments. A system under attack would become unresponsive with 100% CPU utilization but would recover as soon as the attack terminated.
Click to expand...

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180022

guest · Sep 25, 2018

Over 80 Cisco Products Affected by FragmentSmack DoS Bug
September 25, 2018
https://www.bleepingcomputer.com/ne...o-products-affected-by-fragmentsmack-dos-bug/

Cisco is currently looking into its product line to determine which products and services use Linux kernel 3.9 or above, which is vulnerable to the FragmentSmack denial-of-service (DoS) bug.

The networking hardware manufacturer already assembled a list of more than 80 products that are affected by the vulnerability. Many of them expect a fix by February 2019.
Workarounds and mitigation solutions
Until a patch becomes available, Cisco recommends customers check the product-specific documentation for possible workarounds.

In an advisory on Monday, Cisco reminds that off-device mitigations could also be a valid solution for controlling the flow of IP fragments.
Click to expand...

Log in or Sign up

ADV180022 | Windows Denial of Service Vulnerability

Minimalist Registered Member

guest Guest

Log in or Sign up

ADV180022 | Windows Denial of Service Vulnerability

Minimalist Registered Member

guest Guest

Useful Searches