Solved

How to remediate "TCP Sequence Number Approximation" Vulnerability in AIX ?

Posted on 2016-07-26
5
135 Views
Last Modified: 2016-08-27
Hi

Please see the details below.

Vulnerability reported : TCP Sequence Number Approximation Vulnerability
Recommended Solution is to enable MD5 signatures

how to enable MD5 signatures in AIX ? Do we need to implement this on Application/Middle ware side ?

Thank you
0
Comment
Question by:pmsa epic
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
5 Comments
 
LVL 32

Assisted Solution

by:harbor235
harbor235 earned 250 total points (awarded by participants)
ID: 41731625
Another possibility is to enable TCP sequence randomization on network security devices, e.g. firewalls. Cisco ASAs transform and radomize TCP seq numbers, this makes it very hard to guess and potentially hijack the session.

Juniper SRX performs a TCP seq check, invalidating any segments with TCP seq numbers out of the expected range.

Not sure how to do this on the AIX


harbor235 ;}
1
 
LVL 62

Accepted Solution

by:
gheist earned 250 total points (awarded by participants)
ID: 41734929
How big is the damage measured by nmap -O ? Is it much bigger than Windows?
Aix has no tunable parameters to cure it. 15 years ago OpenBSD was only system to jam TCP sequence in passing.
1
 

Author Comment

by:pmsa epic
ID: 41737875
Thank  you. Can it be enabled at Application/middle ware level ?
0
 
LVL 62

Expert Comment

by:gheist
ID: 41747736
No, it is at lower level.
Can you show last line of nmap -O ?
0
 
LVL 62

Expert Comment

by:gheist
ID: 41772799
Gheist says:
best you can get out of AIX alone :
http://lcamtuf.coredump.cx/newtcp/#aix
no -o tcp_icmpsecure=1 makes the pillow more uniform, still very simple (last measured on AIX 6.1, no changes since 4.3.3)
It is far from good. Thats why in-system facility neglected in favour of outside RNG.
0

Featured Post

NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Network ports are the threads that hold network communication together. They are an essential part of networking that can be easily ignore or misunderstood, my goals is to show those who don't have a strong network foundation how network ports opera…
Cybersecurity has become the buzzword of recent years and years to come. The inventions of cloud infrastructure and the Internet of Things has made us question our online safety. Let us explore how cloud- enabled cybersecurity can help us with our b…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

751 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question