Re: Microsoft IKE DoS... source port 500?

From: Crist J. Clark (cristjcat_private)
Date: Mon Dec 31 2001 - 19:10:33 PST

  • Next message: blackshellat_private: "blackshell tool1: SSHD vulnerability scanner" 

    On Sat, Dec 29, 2001 at 06:26:14PM -0500, Abe L. Getchell wrote:
[snip]

> (from http://www.ietf.org/rfc/rfc2408.txt)
> 
> 2.5.1 Transport Protocol
> 
>    ISAKMP can be implemented over any transport protocol or over IP
>    itself.  Implementations MUST include send and receive capability for
>    ISAKMP using the User Datagram Protocol (UDP) on port 500.  UDP Port
>    500 has been assigned to ISAKMP by the Internet Assigned Numbers
>    Authority (IANA). Implementations MAY additionally support ISAKMP
>    over other transport protocols or over IP itself.
> 
> Notice that this doesn't specify that IKE packets _must_ have a source
> port of 500, it simply says 'port 500'.  Can someone point me to any
> piece of documentation which specifies that IKE packets _must_ have a
> source port of 500?  Is this one of those 'unofficial standards' and
> hence the reason for Microsoft's implementation processing these packets
> as normal?

IMHO, demanding that IKE datagrams have a source port of 500 is the
"more buggy" behavior. The RFC says you must be able to "receive on"
and "send on" port 500. It does not say anything about the port we
"send to" or "receive from."
-- 
"It's always funny until someone gets hurt. Then it's hilarious."

Crist J. Clark                     |     cjclarkat_private
                                   |     cjclarkat_private
http://people.freebsd.org/~cjc/    |     cjcat_private

    This archive was generated by hypermail 2b30 : Mon Dec 31 2001 - 19:37:10 PST