PSIRT Advisory
CVE-2004-0230 Blind Reset Attack Using the RST/SYN Bit
Summary
TCP stacks that lack RFC 5961 3.2 & 4.2 support (or have it disabled at application level) may allow remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST or SYN packet.
Impact
Denial of Service (DoS)
Affected Products
FortiAnalyzer 6.2.3 and below
FortiManager 6.2.3 and below
Solutions
Upgrade to FortiAnalyzer 6.2.4 or above
Upgrade to FortiManager 6.2.4 or above
Workaround:
Restrict hosts that can connect to the GUI to trusted ones only, with the trusted host feature.
References
-
The following issues reported by vulnerability scanners are directly linked to this issue:
-
"TCP Sequence Number Approximation Based Denial of Service"
-
"Blind Reset Attack Using the RST/SYN Bit"