IBM Corporation Information for VU#498440

Multiple TCP/IP implementations may use statistically predictable initial sequence numbers


Not Affected

Vendor Statement

We have studied the document written by Guardent regarding vulnerabilities
caused by statistical analysis of random increments, that may allow a
malicious user to predict the next sequence of chosen TCP connections.

IBM's AIX operating system should not be vulnerable as we have implemented
RFC 1948 in our source coding. According to Guardent, we do not expect an
exploit described in the document to affect our AIX OS because we employ
RFC 1948.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References



The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.