SCTP Discussions

Text archives Help


Possible DoS in SCTP ? (was: [SCTP-Discussion] receive of unexpected chunks with invalid parameters)


Chronological Thread 
  • From: Andreas Jungmaier <ajung AT exp-math.uni-essen.de>
  • To: discussion AT sctp.de, Hollaus Thomas <thomas.hollaus AT siemens.at>, "'discussion AT sctp.de'" <discussion AT sctp.de>
  • Cc: tsvwg AT ietf.org
  • Subject: Possible DoS in SCTP ? (was: [SCTP-Discussion] receive of unexpected chunks with invalid parameters)
  • Date: Thu Feb 14 12:32:00 2002
  • List-id: SCTP Discussions <discussion.sctp.de>
  • Organization: University Essen

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello Thomas, dear all,

please see my comments below.
I am CC'ing TSVWG to discuss this: does this open up a possibility
for DoS attacks ?

On Thursday, 14. February 2002 08:56, Hollaus Thomas wrote:
> Dear all,
>
> Question to unexpected chunks with invalid mandatory parameters (e.g.
> MIS=0, OS=0, Init-Tag=0):
> As far as I understand the sctp.de implementation, it is possible to attack
> a running association with e.g. an INIT and invalid mandatory parameters.
> After receive of that unexpected chunks the prototype does delete the
> running association (pre 16: sctp-control.c, func scr_init, line 677). Is
> that a correct behaviour according to RFC?

The implementation probably should return an ABORT with an Error Chunk
that specifies the appropriate error code, as per RFC 2960:
Cause Code
Value Cause Code
--------- ----------------
1 Invalid Stream Identifier
2 Missing Mandatory Parameter
3 Stale Cookie Error
4 Out of Resource
5 Unresolvable Address
6 Unrecognized Chunk Type
--> 7 Invalid Mandatory Parameter
8 Unrecognized Parameters
9 No User Data
10 Cookie Received While Shutting Down

However, I am not actually sure that this is a good idea, since that
would make it easily possible (with IP spoofing) to start
denial-of-service attacks.
I think the rationale behind this in the RFC was to stop a broken
client from keeping retransmitting wrong INITs and tell it directly
WHAT is wrong, and that something is wrong.

Regards,
Andreas

- --
- ------------------------------------------------------------------------
Dipl.-Ing. Andreas Jungmaier | _
Computer Networking Technology Group | ASCII ribbon campaign ( )
University of Essen | - against HTML email X
http://www.exp-math.uni-essen.de/~ajung | & vcards / \
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE8a60YXAsLBNOCSsARAox5AJsE6ZOjMxIdUyH/nsvpuokbGdjeMQCfaTU9
6vbLwcJXTjKeqSx/0zTrepA=
=wK09
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.19+.

Top of page