Product Affected

Extensive testing was done on our products. During the DOS attack, the system would be DOSed (as expected). Systems recovered once the attack was removed.
Low
NA

Problem

Update 8 Sept 2009, 1700 UTC.

 

A "TCP weakness" presented by Outpost24 is slowly leaking to the public (as of October 3, 2008). This TCP weakness has been called the "Sockstress TCP Attack." It is a variant of other "stateless TCP attack tools." Netkill, Ndos, and NAPTHA are examples of the same sort of stateless TCP attack tools. The Sockstress TCP Attack is not a "new" TCP attack, just an optimization on an existing "class" of TCP attacks.

 

CERT-FI has released details of the Sockstress Attack. These details can be found here:

https://www.cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.html

Juniper Networks received the Sockstress tool and executed testing on all our platforms. We have found no unexpected or adverse impact to our equipment which is different from other types of TCP Denial of Service (DOS). When the Sockstress DOS attack is removed, Juniper systems recover normally.

 

 

Solution

Given that Sockstress is not a new 'class' of TCP attacks, existing Best Common Practices (BCPs) used to protect Juniper products from TCP based DOS attacks are the best investment of time.

Workaround

NA

Severity Assessment

Juniper Networks received the Sockstress tool and executed testing on all our platforms. We have found no unexpected or adverse impact to our equipment which is different from other types of TCP Denial of Service (DOS). When the Sockstress DOS attack is removed, Juniper systems recover normally. Given that Sockstress is not a new 'class' of TCP attacks, existing Best Common Practices (BCPs) used to protect Juniper products from TCP based DOS attacks are the best investment of time.

Modification History

Initial publication: 10/22/2008

Related Information