Non-random ip id's

[Peter Gillis]

After running a network vulnerability scan on our system we have a message returned that indicates it is possible to predict the next
value of the ip_id field of the ip packets sent by this host.

Anyone suggest how we can cause random values for ip-ids in ip packets to be the norm?

We are running ux11.0 op system.

thanks
Maria

[Tony Horton]

I assume we are talking about the initial sequence numbers here. I thought that HP-UX was actually very good in that respect, I'm pretty sure I've done a scan on our 11.0 box and that it came up as completely random (I can't remember if that was using nmap or nessus)...... Maybe you should check your ARPA patch levels, it could be that it was bad, but HP have released a patch to fix it.

Regards,

Tony.

[Keith Buck · Accepted solution]

Here is the security bulletin archive:

http://www1.itrc.hp.com/service/cki/secBullArchive.do

Check out bulletin 205. You'l want at least patch PHNE_26771, which then gives you a choice of "HP randomization" or RFC1948 randomization.

-Keith

[Mark Greene_1]

This is a known issue. Two years ago someone did a study of IP sequence numbers, and then redid the same study a year later to gauge how vendors addressed the problem.

Results for HP from the second study can be seen here:

http://lcamtuf.coredump.cx/newtcp/#hpux

Apply the patch and follow the instructions to activate the change and you should be all set.

mark

[rick jones]

at the risk of showing my ignorance, what is the perceived security threat with a non random IP datagram ID? (I'm not talking about TCP ISN, but IP datagram ID here)

[Mark Greene_1]

rick,

see here for one man's take on the risks:

http://lcamtuf.coredump.cx/newtcp/#risks

mark

[rick jones]

mark -

thanks for the pointer - perhaps I dind't read far enough, but the first bit there seemed to be concerned only with TCP sequence numbers and spoofed IP addresses and didn't say anything about IP datagram IDs, which to the best of my knowledge are used only in IP fragment reassembly.

i suppose that one might argue that an attacker might then be able to "insert" replacement IP datagram fragments in the middle of a fragmented IP datagram, but that seems very remote as the chances of being able to put something useful there that still passes the TCP (which avoids fragmentation) or UDP checksum seems remote at best.