Protection Against a Variant of the Tiny Fragment Attack (RFC 1858)
RFC 3128

Document Type RFC - Informational (June 2001; No errata)
Updates RFC 1858
Was draft-miller-rfc1858-cmts (individual)
Author Ian Miller 
Last updated 2013-03-02
Stream Legacy
Formats plain text html pdf htmlized bibtex
Stream Legacy state (None)
Consensus Boilerplate Unknown
RFC Editor Note (None)
IESG IESG state RFC 3128 (Informational)
Telechat date
Responsible AD (None)
Send notices to (None)
Network Working Group                                          I. Miller
Request for Comments: 3128                                Singularis Ltd
Updates: 1858                                                  June 2001
Category: Informational

        Protection Against a Variant of the Tiny Fragment Attack

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2001).  All Rights Reserved.


   This document discusses how RFC 1858 compliant filters can be
   vulnerable to a variant of the "Tiny Fragment Attack" described in
   section 3.1 of the RFC.  This document describes the attack and
   recommends corrective action.

1. Introduction

   RFC 1858 provides an excellent description of a class of attack on
   Internet firewalls and proposes countermeasures.  However one of
   these countmeasures, the "Indirect Method" (section 3.2.2) is
   vulnerable to a combination of two of the attacks described.

   The attack combines the features of the "Tiny Fragment Attack"
   (section 3) and the "Overlapping Fragment Attack" (section 4).

1.1 The scope of the attack

   Where the filtering rules allow incoming connections to a machine AND
   there other ports which allow only outgoing connections on the same
   host, the attack allows incoming connections to the supposedly
   outgoing-only ports.

   Note that only the initial connection message need be fragmented.
   Once the connection is established further traffic on it is legal.
   The significance of this weakness will depend on the security policy
   in force.

Miller                       Informational                      [Page 1]
RFC 3128       Protection Against a Tiny Fragment Attack       June 2001

2. The Tiny Overlapping Fragment Attack

   The attack typically consists of sending three fragments.

   Fragment 1: (Fragment offset = 0; length >= 16)
      Includes whole header and is entirely legal.  Typically it
      describes a SYN packet initiating a new TCP connection to a port
      on the target host that is allowed to receive incoming
      e.g., Incoming connection to port 25 SMTP.

   Fragment 2: (Fragment offset = 0; length = 8)
      Is only the first 8 bytes and could be legal depending on the
      other 8-bytes of the header, but is NOT legal combined with the
      corresponding bytes from Fragment 1.  Such a fragment includes
      only the port numbers and sequence number from the TCP header.
      Typically this packet replaces the destination port number with a
      port number on which the destination host that is not allowed to
      receive incoming connections.

   Fragment 3:  (Fragment offset >= 2; length = rest of message)
      Contains no header and completes the message.  (This third
      fragment is not part of the attack.  However Fragment 1 cannot be
      the complete message or it would be passed up to the application
      before Fragment 2 arrived so a third fragment is necessary.)

2.1 Example of the attack

   Consider the following trivial set of rules for incoming packets:

   | No|Action | Source| Dest. | Flags | Purpose               |
   |   |       | Port  | Port  |       |                       |
   | 1 |Permit | >1023 | SMTP  |  ANY  | Incoming E-mail       |
   | 2 |Permit | >1023 |  ANY  |  Ack=1| Existing FTP data     |
   |   |               |       |       | channel connections.  |
   | 3 |Deny   | ANY   |  ANY  |  ANY  | Default deny          |

   Fragment 1: attacker(1234) -> target(SMTP) Ack=0
      This is a new SMTP connection and is permitted by rule 1.

   Fragment 2: attacker(1234) -> target(Telnet=23) Ack=absent
      All fields present conform to rule 2, as it could be the start of
      an FTP packet.

Miller                       Informational                      [Page 2]
RFC 3128       Protection Against a Tiny Fragment Attack       June 2001

   Depending on the precise implementation of the fragment reassembly in
   the target machine's IP stack, fragment B may overwrite fragment A to

      attacker(1234) -> target(Telnet) Ack=0
          (new telnet connection)

2.2 The failure of "Indirect Method"

   The Indirect Method attempts to solve both Tiny Fragment and
   Overlapping Fragment attacks, solely by rejecting packets with FO=1.
   However none of the above fragments have FO=1, so none are rejected.

   The failure is clear on careful reading.  In section 3.2.2 "Indirect
   Method", RFC 1858 states:-

      The indirect method relies on the observation that when a TCP
Show full document text