Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #4969
| From | Clément Hermann <nodens@nodens.org> |
|---|---|
| Newsgroups | linux.debian.security |
| Subject | Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) |
| Date | 2016-08-12 18:10 +0200 |
| Message-ID | <s5nbY-3S3-53@gated-at.bofh.it> (permalink) |
| References | <s4XKx-3Wr-5@gated-at.bofh.it> <s5mIW-3sw-31@gated-at.bofh.it> <s5mSC-3vM-11@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Le 12/08/2016 à 17:46, Jakub Wilk a écrit : > * Salvatore Bonaccorso <carnil@debian.org>, 2016-08-12, 17:35: >> mitigation could be used as per https://lwn.net/Articles/696868/ . > > This is behind paywall at the moment. The relevant part appears to be: > >> there is a mitigation available in the form of the >> tcp_challenge_ack_limit sysctl knob. Setting that value to something >> enormous (e.g. 999999999) will make it much harder for attackers to >> exploit the flaw. > The akamai blog describe the workaround as well [1], you could implement it with: |sysctl net.ipv4.tcp_challenge_ack_limit=1073741823; grep -q tcp_challenge_ack_limit /etc/sysctl.conf /etc/sysctl.d/* || echo "net.ipv4.tcp_challenge_ack_limit=1073741823" >> /etc/sysctl.d/cve-2016-5696.conf| [1] https://blogs.akamai.com/2016/08/vulnerability-in-the-linux-kernels-tcp-stack-implementation.html Cheers ! -- Clément (nodens)
Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
DSA for CVE-2016-5696 (off-path blind TCP session attack) Richard van den Berg <richard@vdberg.org> - 2016-08-11 15:00 +0200
Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Salvatore Bonaccorso <carnil@debian.org> - 2016-08-12 17:40 +0200
Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Jakub Wilk <jwilk@debian.org> - 2016-08-12 17:50 +0200
Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Clément Hermann <nodens@nodens.org> - 2016-08-12 18:10 +0200
Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Rick Moen <rick@linuxmafia.com> - 2016-08-12 22:50 +0200
Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Sam Morris <sam@robots.org.uk> - 2016-08-15 20:50 +0200
Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Paul Wise <pabs@debian.org> - 2016-08-16 04:30 +0200
Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Elmar Stellnberger <estellnb@gmail.com> - 2016-08-16 21:40 +0200
Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Dylan Frese <dmfrese@gmail.com> - 2016-08-16 21:50 +0200
csiph-web