CAPEC-332 Detail

CAPEC-332

Name

ICMP IP 'ID' Field Error Message Probe

Likihood attacks

Medium

Typical Severity

Low

Status

Stable

Published

2014-06-23
00h00 +00:00

Modified

2023-01-24
00h00 +00:00

Official links

CAPEC Mitre.org

Alerte pour un CAPEC

Stay informed of any changes for a specific CAPEC.

Notifications manage

List of Notifications

Alerte pour un CAPEC

Stay informed of any changes for a specific CAPEC.

Parameters

You can specify a title that will be retrieved in the alerts that will be sent out.

Specify the CAPEC ID you wish to monitor.

Planning

Month

Next run calculation

Day

Weekday

Hour

Minute

Creation date

Last execution

Next execution

Functionality requiring a connection

This feature, which allows you to receive alerts, is only active when you are logged into your account.

Descriptions CAPEC

An adversary sends a UDP datagram having an assigned value to its internet identification field (ID) to a closed port on a target to observe the manner in which this bit is echoed back in the ICMP error message. This allows the attacker to construct a fingerprint of specific OS behaviors.

Informations CAPEC

Prerequisites

The ability to monitor and interact with network communications. Access to at least one host, and the privileges to interface with the network interface card.

Resources Required

A tool capable of sending/receiving UDP datagram packets from a remote system to a closed port and receive an ICMP Error Message Type 3, "Port Unreachable."

Related Weaknesses

CWE-ID	Weakness Name
CWE-204	Observable Response Discrepancy The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

References

REF-33

Hacking Exposed: Network Security Secrets & Solutions
Stuart McClure, Joel Scambray, George Kurtz.

REF-123

RFC792 - Internet Control Messaging Protocol
J. Postel.
http://www.faqs.org/rfcs/rfc792.html

REF-124

RFC1122 - Requirements for Internet Hosts - Communication Layers
R. Braden, Ed..
http://www.faqs.org/rfcs/rfc1122.html

REF-262

A Remote Active OS Fingerprinting Tool using ICMP
Ofir Arkin.
http://ofirarkin.files.wordpress.com/2008/11/login.pdf

Submission

Name	Organization	Date	Date release
CAPEC Content Team	The MITRE Corporation	2014-06-23 +00:00

Modifications

Name	Organization	Date	Comment
CAPEC Content Team	The MITRE Corporation	2017-05-01 +00:00	Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Related_Attack_Patterns, Resources_Required, Typical_Likelihood_of_Exploit
CAPEC Content Team	The MITRE Corporation	2018-07-31 +00:00	Updated Description, Description Summary
CAPEC Content Team	The MITRE Corporation	2022-02-22 +00:00	Updated Description, Extended_Description
CAPEC Content Team	The MITRE Corporation	2023-01-24 +00:00	Updated Related_Weaknesses, Resources_Required