Dear Marc Ruef, MR> III. EXPLOITATION MR> Running TCP SYN flooding is very simple and can be realized by a large MR> variety of public attack tools. But it is also possible to initialize MR> such an attack my misusing a port scanning utility. Starting a scan with MR> nmap by Fyodor with the following command is able to reproduce the MR> denial of service: MR> nmap -PS80 192.168.0.0/24 Note: This is a device which costs 44,44€ You fail to say whether this is done from INSIDE -> OUTSIDE or vice versa, which really is the point which makes this a "vulnerability" instead of a simple bug. I found countless other Gateways "vulnerable" to this, most SHO DSL gateways even crash when you run Emule for 24hours (same cause). The reason is that with the NAT functions they simply can't handle a larger NAT Table (which grows quite rapidely with SYN scanning..). I never reported this issue because I thought and I still think this is not really an security issue. >VI. WORKAROUND >Do not plug the RP114 in not-trusted networks where the inter-connection >requires a high availability. Who will use an RP114 (44€) for in an high availability environment? PS. Don't do Pentests over SOHO DSL gateways... it is a baaaad idea. -- http://secdev.zoller.lu Thierry Zoller Fingerprint : 5D84 BFDC CD36 A951 2C45 2E57 28B3 75DD 0AC6 F1C7
