CentOS - Jun 2016 - UDP Constant IP Identification Field Fingerprinting Vulnerability

On Fri, June 24, 2016 12:24, John R Pierce wrote:
> On 6/24/2016 9:20 AM, James B. Byrne wrote:
>> We received a notice from our pci-dss auditors respecting this:
>>
>> CVE-2002-0510 The UDP implementation in Linux 2.4.x kernels keeps
>> the
>> IP Identification field at 0 for all non-fragmented packets, which
>> could allow remote attackers to determine that a target system is
>> running Linux.
>
>
> 2.4 kernels are kinda old.   kinda really really old.    are you still
> running CentOS 4 on PCI audited systems ?!??
>
>
The CVE is from 2002 and the kernel mentioned refers to the original
report.  Linux core team said it was a non-problem and the issue
remains in the kernel found in CentOS-6.8.  Possibly the one in 7.
Perhaps it is still present in the development branch.

However, all I am seeking is knowledge on how to handle this using
iptables.  I am sure that this defect/anomaly has already been solved
wherever it is an issue.  Does anyone have an example on how to do
this?


-- 
***          e-Mail is NOT a SECURE channel          ***
        Do NOT transmit sensitive data via e-Mail
 Do NOT open attachments nor follow links sent by e-Mail

James B. Byrne                mailto:ByrneJB at Harte-Lyne.ca
Harte & Lyne Limited          http://www.harte-lyne.ca
9 Brockley Drive              vox: +1 905 561 1241
Hamilton, Ontario             fax: +1 905 561 0757
Canada  L8E 3C3

On 06/26/2016 01:50 PM, James B. Byrne wrote:
> However, all I am seeking is knowledge on how to handle this using
> iptables.  I am sure that this defect/anomaly has already been solved
> wherever it is an issue.  Does anyone have an example on how to do
> this?

I think the bit you're missing is that you don't have to address every 
detail that your auditors send you.  You can label an item a false 
positive.  You can respond that you are aware, and that you don't 
consider an item to be a security defect.  Fingerprinting is an 
excellent example thereof.  As was already noted, the IP ID field is 
just one of many aspects of IP networking that can be used to identify 
Linux systems.  If you don't address them all, addressing one is not a 
useful exercise.

Still, if you enjoy jumping through hoops, there used to be a few 
options to do this:

https://nmap.org/misc/defeat-nmap-osdetect.html

The comment you quoted did not say that the field could be mangled by 
iptables, and as far as I can tell, no module is available to mangle 
that field.

http://www.iptables.info/en/structure-of-iptables.html#MANGLETABLE

And if none of those are acceptable, then consider upgrading to a newer 
system.  Fyodor says that recent versions of Linux no longer behave this 
way.

http://seclists.org/bugtraq/2002/Mar/372