On Wed Jun 15 2005 at 22:10, Bilal Nasrallah wrote: > I ran a scan against a network device and one of the vulnerability > highlighted by the report was "Predictable TCP sequence number".
This means that it is possible to do "blind" source IP spoofing against the device... tcp_seq.nasl is really a simple test. So when it says "predictable", it means that it can be predicted *very easily*. Nothing like http://lcamtuf.coredump.cx/newtcp/ > However, the vender replied back that indicating that shouldn't be > an issue because all TCP sessions to the device are > encrypted via SSL or SSH and require password authentication. I wouldn't bet that an attack cannot be set up. At least some kind of denial of service. It is hard to tell without any details on this gizmo and the intended use & environment. > Would the vulnerability in this case considered a false positive? The flaw is here. It is mitigated, or even not exploitable in your environment, but it is a "false positive" per se. It would be if tcp_seq.nasl triggered against an IP stack that implements strong random number generation for TCP sequence numbers -- e.g. Linux, OpenBSD... and most up to date operating systems. By the way, did you run your test in "safe check" mode or did you try a full scan? _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus
