Re: DSA for CVE-2016-5696 (off-path blind TCP session attack)

From	Elmar Stellnberger <estellnb@gmail.com>
Newsgroups	linux.debian.security
Subject	Re: DSA for CVE-2016-5696 (off-path blind TCP session attack)
Date	2016-08-16 21:40 +0200
Message-ID	<s6Sno-7ee-25@gated-at.bofh.it> (permalink)
References	<s4XKx-3Wr-5@gated-at.bofh.it> <s5mIW-3sw-31@gated-at.bofh.it> <s5mSC-3vM-11@gated-at.bofh.it> <s6v7r-II-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Has anyone every thought of an in-path TCP session attack and of 
encrypting sequence numbers by a given secret negotiated in advance 
between both endpoints? If an intelligence service ever wanted to do so 
I guess they could drive an in-path attack against TCP (as they tend to 
sit on the internet backbones everywhere they could easily listen to all 
packets that pass by.).

Am 2016-08-15 um 20:42 schrieb Sam Morris:
> On Fri, 12 Aug 2016 17:46:56 +0200, Jakub Wilk wrote:
>
>> * Salvatore Bonaccorso <carnil@debian.org>, 2016-08-12, 17:35:
>>> mitigation could be used as per https://lwn.net/Articles/696868/ .
>>
>> This is behind paywall at the moment.
>
> Anyone who wishes to read this may use the following link:
>
> https://lwn.net/SubscriberLink/696868/4d074b4d12dcb3dc/
>
> And if you like the article, consider subscribing to LWN! Now that I
> think about it, I'm pretty sure there's a group membership available to
> all DDs anyway.
>

Thread

DSA for CVE-2016-5696 (off-path blind TCP session attack) Richard van den Berg <richard@vdberg.org> - 2016-08-11 15:00 +0200
  Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Salvatore Bonaccorso <carnil@debian.org> - 2016-08-12 17:40 +0200
    Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Jakub Wilk <jwilk@debian.org> - 2016-08-12 17:50 +0200
      Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Clément Hermann <nodens@nodens.org> - 2016-08-12 18:10 +0200
      Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Rick Moen <rick@linuxmafia.com> - 2016-08-12 22:50 +0200
      Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Sam Morris <sam@robots.org.uk> - 2016-08-15 20:50 +0200
        Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Paul Wise <pabs@debian.org> - 2016-08-16 04:30 +0200
        Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Elmar Stellnberger <estellnb@gmail.com> - 2016-08-16 21:40 +0200
          Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Dylan Frese <dmfrese@gmail.com> - 2016-08-16 21:50 +0200

csiph-web