Subject: Consensus action: ACCEPT [LL11] Add security consideration for the threat where an attacker forces address reconfiguration

From: Erik Guttman <[email-masked]>
Date: Mon, 17 Feb 2003 17:58:54 +0100

ACTION: Accept

RESULT: Add the following sections to the Security
         Considerations section.

================
Add paragraph 1
================
    A host implementing IPv4 link-local configuration has the additional
    vulnerability to selective reconfiguration and disruption. It is
    possible for an on-link attacker to issue ARP packets that would
    cause a host to believe  the address it is using is also being
    used by someone else and must be given up. Giving up the address
    and configuring another address will cause a host to break all its
    connections by switching to a new address. The attacker could force
    the host implementing IPv4 link-local configuration to select
    certain addresses, or prevent it from ever completing address
    selection. This is a distinct threat from that posed by fraudulent
    ARPs, described in the preceding paragraph.

================
Add paragraph 2
================
    Implementations and users should also note that a node that
    gives up an address and reconfigures, as required by section 2.5,
    allows the possibility that another node can easily successfully
    hijack existing TCP connections.  Before abandoning an address
    due to a conflict, hosts SHOULD actively attempt to reset any
    existing connections using that address.

NOTE:	Stuart Cheshire and Aidan Williams argue that the
	paragraph 2 above is not a threat introduced by IPv4LL.
	There was no disagreement that this is a real threat, though.

  	Suggestion:  Raise a new issue which proposes additional text
  	to indicate that paragraph 2 is not an issue specific to IPv4LL
  	but it is worth considering for implementors of IPv4LL.

Erik
ZEROCONF WG chair