TCP Sequence Number Approximation Based Denial of Service?

[tmcca]

I am doing a PCI scan and got the following:

TCP Sequence Number Approximation Based Denial of Service

Refer to US-CERT Vulnerability Note VU#415294 and OSVDB Article 4030 to obtain a list of vendors affected by this issue and a note on resolutions (if any) provided by the vendor.

is there a fix for this?

[Hu]

TCP is not used to access PCI or PCIe devices. Such devices are locally attached, rather than accessed over the network. I suppose you might have a PCI / PCIe card for TCP offload and have that vulnerability in the firmware of the offload card. If so, you need to consult with the maker of that card for a firmware update. Otherwise, please provide more information. What exactly did you do that led to that message? What device(s) do you think have this problem? Why are you asking about those devices on a Gentoo forum?

[Ant P.]

Are you running a BGP router?

[freke]

[ct85711]

https://lwn.net/Articles/81560/

This link describes more of the issue, and why it is effectively ignored outside of hosts using BGP routers. In short, the reason why it is only a issue for BGP routers, is more of on the importance of the tcp link staying up. For regular tcp links, (like for http, email and such) tcp links are short lived. As the article explains, it is like this, consider if the link for you downloading something gets closed due to this. What are you going to do? Simply try again, simple as that (a whole new link is made). BGP routers on the other hand depend on communicating with neighbor BGP routers, to know how to route stuff. If that link is closed; the router has to trash all those routes (thus killing off part of the network).

[Hu]