Vendors fixing bug that could crash Internet systems

Internet infrastructure vendors are working on patches for a set of security flaws that could help hackers knock servers offline with very little effort.

The security community has been buzzing about the bugs since Tuesday, when security researcher Robert Hansen discussed the problem on his blog.

Technical details on the vulnerabilities have not been released, but the security experts who discovered the problem, Robert Lee and Jack Louis of security vendor Outpost24, say that they can knock Windows, Linux, embedded systems and even firewalls offline with what's known as a denial of service (DOS) attack. The flaws lie in the TCP/IP (Transmission Control Protocol/Internet Protocol) software used by these systems to send data over the Internet.

Lee and Louis first discussed the problem last week at a conference in Amsterdam, and many of the affected vendors are now working on patching the issue with help from the Finnish national Computer Emergency Response Team, said Lee, who spent most of Wednesday and Thursday explaining the issue.

"The vendors who are capable and responsible for creating solutions are in the loop," said Lee, Outpost24's chief security officer. "The public message here is 'Chill out, the people who need to be involved are involved.'"

He could not say how long it would take to fix the problem.

In a statement, Microsoft said it was investigating the matter and that it was "unaware of any attacks trying to use the claimed vulnerability or of customer impact."

But according to Hansen, if attacks did appear, they could be bad. That's because they can be launched with very little bandwidth and because machines targeted would often remain disabled even after the DOS attack has stopped.

"This appears not to be a single bug, but in fact at least five, and maybe as many as 30 different potential problems," Hansen, the CEO of SecTheory, wrote on his blog. "They just haven't dug far enough into it to really know how bad it can get. The results range from complete shutdown of the vulnerable machine, to dropping legitimate traffic."

Lee and Louis are set to discuss the flaws two weeks from now at the T2 conference in Helsinki, but they will not release additional details if the flaws remain unpatched, Lee said.

Arbor Networks Chief Security Officer Danny McPherson said that while talking about the flaw without revealing the technical details may generate buzz for Lee and Louis' conference presentation, it provides little value to users. "These partial disclosures really do little more than trigger a slew of skepticism," he said via instant message.

The IDG News Service is a Network World affiliate.