Redback Networks Inc. Information for VU#637934

Impact of CERTŪ Advisory VU#637934 on Redback Products

Vulnerability Description: Systems with persistent TCP connections might be affected by this vulnerability.

The TCP Timestamps option (RFC1323) is deployed widely. There is a variant of the TCP Timestamps option, which would supposedly be more prevalent than the standard algorithm. The variant, however, has a vulnerability which allows malicious, off-path third parties to stall TCP connections.

More details on this vulnerability can be found at the CERT website. (www.cert.org)

Impacted Redback Products: NONE of Redback SmartEdge 400, 800 Routers; Redback SmartEdge 400, 800 Service Gateway Systems are impacted by this issue.
NONE of the products of SMS product-line are affected by this issue

Why Redback products are not affected:
The TCP/IP stack on both of Redback product-lines already implements all validation procedures outlined in the CERT advisory before a packet is accepted and the session timestamp updated. Consequently, TCP applications on Redback products are not vulnerable to this attack.

Recommended Best Practice to Guard Against TCP Attacks: While there is no way a network operator can completely defend against various vulnerabilities and hacker attacks, Redback Networks products already implement many mechanisms to guard against such attacks. Some examples include:
· MD5 authentication for TCP

· IP source address validation on any subscriber circuit, so no subscriber terminated on the box can participate in this type of attack.

Vulnerability Resolution: NOT Required on this since Redback product-lines are not affected.

For further assistance or information regarding this topic contact the Redback Networks Technical Assistance Center (TAC). TAC is prepared to provide worldwide support for security workarounds that address this issue. There are several known workarounds that can significantly reduce this exposure. The Redback domestic TAC number is (877) 733 2225 and International TAC phone number is 31-104987777. Redback TAC will provide detailed information to our worldwide systems engineers and focal engineers to assist customers in configuring these workarounds.

Vendor Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.