The Ping of Death

The Ping of Death is an attack that exploits the fragmentation vulnerability of large ICMP ECHO request (that is, "ping") packets. A sample ICMP ECHO request packet is shown in Figure 4-11.

Figure 4-11: An ICMP ECHO Request Packet

The ICMP ECHO request packet consists of eight octets of ICMP header information followed by the number of data octets in the ping request. The maximum allowable size of the data area is therefore calculated this way:

The problem is that it is possible to send an illegal ICMP ECHO packet with more than 65,507 octets of data because of the way the fragmentation is performed. The fragmentation relies on an offset value in each fragment to determine where the individual fragment goes when it is reassembled. Therefore, on the last fragment, it is possible to combine a valid offset with a suitable fragment size so that the following is true:

Because typical machines don't process the packet until they have all the fragments and have tried to reassemble them, there is the possibility of the overflow of 16-bit internal variables, which can lead to system crashes, reboots, kernel dumps, and other unwarranted behavior.

Note This vulnerability is not restricted to the ping packet. The problem can be exploited by sending any large IP datagram packet.

A temporary fix to prevent the Ping of Death is to block ping packets at the ingress points to the corporate network. The ideal solution is to secure the TCP/IP implementation against overflow when reconstructing IP fragments.

Continue reading here: Risk Mitigation and the Cost of Security

Was this article helpful?

0 0