Check Point Advisories

Security Best Practice: Protect Yourself from Ping of Death Attacks

Check Point Reference:	SBP-2008-18
Date Published:	15 Aug 2008
Severity:	Medium
Last Updated:	Thursday 11 March, 2010
Source:	IPS Research Center
Industry Reference:	CVE-1999-0128
Protection Provided by:
Who is Vulnerable?	Computers and Networks
Vulnerability Description	A Ping of Death (POD) is a type of attack on a computer that involves sending a malformed or otherwise malicious ping to a computer. A ping is normally 56 bytes in size (or 84 bytes when IP header is considered); historically, many computer systems could not handle a ping packet larger than the maximum IP packet size, which is 65,535 bytes. Sending a ping of this size could crash the target computer.
Vulnerability Details	Generally, sending a 65,536 byte ping packet is illegal according to networking protocol, but a packet of such a size can be sent if it is fragmented; when the target computer reassembles the packet, a buffer overflow can occur, which often causes a system crash. The attacker sends a fragmented ping request that exceeds the maximum IP packet size (64KB).