CVE-2004-0230: TCP Sequence Number Approximation Based Denial of Service - IGA Applications are not vulnerable
Article ID: 277049
Updated On:
Products
Issue/Introduction
Are IGA products vulnerable due to CVE-2004-0230: TCP Sequence Number Approximation Based Denial of Service?
CVE-2004-0230
TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (terminate network sessions) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as Border Gateway Protocol (BGP).
Vulnerability Additional Details:
The vulnerable situation arises due to Border Gateway Protocol (BGP) relies on long-lived persistent Transmission Control Protocol (TCP) to maintain persistent unauthenticated network sessions with larger window sizes to function. The ability to predict Initial Sequence Number (ISN)s within these windows can lead to TCP connection hijacking or spoofing.
The primary function of Border Gateway Protocol (BGP) is to exchange routing and reachability information among different autonomous systems on the internet. When a BGP session is disrupted, the BGP application restarts and attempts to re-establish a connection to its peers. This may result in a brief loss of service until the fresh routing tables are created.
Environment
All IGA Products
Resolution
Why IGA Application is not vulnerable?
In an enterprise secure network, the client/server TCP communication of IGA point products do not rely on persistent unauthenticated network sessions to serve its application capabilities. IGA TCP packet communication does not rely on BGP routing tables to process the client requests' routing. IGA uses keep-alive connection within an authenticated session for all subsequent communication between client/server and the session is time-bound and it does not open or rely on unauthenticated session windows to enable sequence number guessing. Hence, the possibility of injecting a TCP RST packet to disrupt the TCP connection within IGA deployment is not possible.
Feedback
