Solved

How to remediate "TCP Sequence Number Approximation" Vulnerability in AIX ?

Posted on 2016-07-26
5
125 Views
Last Modified: 2016-08-27
Hi

Please see the details below.

Vulnerability reported : TCP Sequence Number Approximation Vulnerability
Recommended Solution is to enable MD5 signatures

how to enable MD5 signatures in AIX ? Do we need to implement this on Application/Middle ware side ?

Thank you
0
Comment
Question by:pmsa epic
  • 3
5 Comments
 
LVL 32

Assisted Solution

by:harbor235
harbor235 earned 250 total points (awarded by participants)
ID: 41731625
Another possibility is to enable TCP sequence randomization on network security devices, e.g. firewalls. Cisco ASAs transform and radomize TCP seq numbers, this makes it very hard to guess and potentially hijack the session.

Juniper SRX performs a TCP seq check, invalidating any segments with TCP seq numbers out of the expected range.

Not sure how to do this on the AIX


harbor235 ;}
1
 
LVL 62

Accepted Solution

by:
gheist earned 250 total points (awarded by participants)
ID: 41734929
How big is the damage measured by nmap -O ? Is it much bigger than Windows?
Aix has no tunable parameters to cure it. 15 years ago OpenBSD was only system to jam TCP sequence in passing.
1
 

Author Comment

by:pmsa epic
ID: 41737875
Thank  you. Can it be enabled at Application/middle ware level ?
0
 
LVL 62

Expert Comment

by:gheist
ID: 41747736
No, it is at lower level.
Can you show last line of nmap -O ?
0
 
LVL 62

Expert Comment

by:gheist
ID: 41772799
Gheist says:
best you can get out of AIX alone :
http://lcamtuf.coredump.cx/newtcp/#aix
no -o tcp_icmpsecure=1 makes the pillow more uniform, still very simple (last measured on AIX 6.1, no changes since 4.3.3)
It is far from good. Thats why in-system facility neglected in favour of outside RNG.
0

Featured Post

Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
If you thought ransomware was bad, think again! Doxware has the potential to be even more damaging.
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Viewers will learn how to properly install and use Secure Shell (SSH) to work on projects or homework remotely. Download Secure Shell: Follow basic installation instructions: Open Secure Shell and use "Quick Connect" to enter credentials includi…

756 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question