3 ms·
It's not smuggling a SIP session request via HTTP headers - even if it didn't look anything like HTTP it would be vulnerable to this attack, because the control
by chc4 6y ago
It's not smuggling a SIP session request via HTTP headers - even if it didn't look anything like HTTP it would be vulnerable to this attack, because the controlled fragment is arbitrary binary data from their POST body. The problem is the router's firmware doing detection on each packet without checking that the fragment offset is 0 first.
- viraptor 6y agoI didn't say it relies on http headers. Just made a guess on what alg may be doing. Yeah - it's broken with fragmentation, and possibly in other ways too.