From owner-freebsd-security  Thu Jan  3 13: 7:53 2002
Delivered-To: freebsd-security@freebsd.org
Received: from niwun.pair.com (niwun.pair.com [209.68.2.70])
	by hub.freebsd.org (Postfix) with SMTP id BD3B037B41C
	for <freebsd-security@freebsd.org>; Thu,  3 Jan 2002 13:07:44 -0800 (PST)
Received: (qmail 66000 invoked by uid 3193); 3 Jan 2002 21:07:43 -0000
Received: from localhost (sendmail-bs@127.0.0.1)
  by localhost with SMTP; 3 Jan 2002 21:07:43 -0000
Date: Thu, 3 Jan 2002 16:07:43 -0500 (EST)
From: Mike Silbersack <silby@silby.com>
X-Sender:  <silby@niwun.pair.com>
To: Matthias Schuendehuette <msch@snafu.de>
Cc: <freebsd-security@freebsd.org>, <freebsd-stable@freebsd.org>,
	<Peter.Sauerland@siemens.com>, <iss@cert.siemens.de>
Subject: Re: TCP Sequence-Prediction (4.5-PRE)
In-Reply-To: <E16MExc-0003MK-00@clever.eusc.inter.net>
Message-ID: <Pine.BSF.4.30.0201031604560.45843-100000@niwun.pair.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


On Thu, 3 Jan 2002, Matthias Schuendehuette wrote:

> Hello,
>
> my machine at work was scanned with the ISS Scanner, Vers. 6.2.1 and it
> complained about TCP Sequence Prediction:
>
> 'The TCP sequence was found to be predictable.'

Run tcpdump while a scan is happening so that you can see what is going on
with the sequence numbers.  4.5's TCP initial sequence numbers should not
be predictable.

Mike "Silby" Silbersack


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message