As disclosed earlier, by exploiting these vulnerabilities, an attacker could easily cause a Denial-of-Service (DoS) at the target server by bombarding it with modified data packets. The difference between the two lies in their target – SegmentSmack targeted ongoing TCP sessions with modified data packets, whereas FragmentSmack relied on sending modified IP packets to the IP fragment reassembly. Both the vulnerabilities caused excessive resource usage leading to a denial of service.
“Microsoft is aware of a denial of service vulnerability (named "FragmentSmack" CVE-2018-5391) affecting Windows systems. An attacker could send many 8-byte sized IP fragments with random starting offsets, but withhold the last fragment and exploit the worst-case complexity of linked lists in reassembling IP fragments. A system under attack would become unresponsive with 100% CPU utilization but would recover as soon as the attack terminated.”While the vulnerabilities already affected Linux users, their next target included Windows users. The vulnerabilities affected Windows 10, 8.1, 7, Windows Server 2008, Windows Server 2012, and Windows Server 2016.
Microsoft have already released their security update for this vulnerability on September 9, 2018, and also published the advisory. It then merely updated the information whilst releasing the September Patch Bundle. Users should make sure to update their systems so as to stay protected from these vulnerabilities.
Let us know your thoughts about the article in the comment section below.
