312-50V11 · Question #371
Which of the following network attacks takes advantage of weaknesses in the fragment reassembly functionality of the TCP/IP protocol stack?
The correct answer is A. Teardrop. The Teardrop attack exploits TCP/IP fragment reassembly by sending overlapping malformed IP fragments that the target OS cannot correctly reconstruct.
Question
Which of the following network attacks takes advantage of weaknesses in the fragment reassembly functionality of the TCP/IP protocol stack?
Options
- ATeardrop
- BSYN flood
- CSmurf attack
- DPing of death
How the community answered
(23 responses)- A87% (20)
- B9% (2)
- D4% (1)
Why each option
The Teardrop attack exploits TCP/IP fragment reassembly by sending overlapping malformed IP fragments that the target OS cannot correctly reconstruct.
Teardrop sends a sequence of IP fragments with deliberately overlapping offset values, causing the receiving system's TCP/IP stack to fail during reassembly as it cannot reconcile the conflicting fragment boundaries. This vulnerability in fragment reassembly logic can cause the target system to crash or hang, making it a denial-of-service attack specifically targeting the IP fragmentation mechanism.
SYN flood exploits the TCP three-way handshake by sending large numbers of SYN packets without completing the connection, exhausting server connection tables rather than targeting fragmentation.
A Smurf attack uses ICMP echo requests sent to a broadcast address with a spoofed victim source IP, amplifying traffic back to the victim and has no relation to fragment reassembly.
Ping of Death sends a single ICMP packet exceeding the 65,535-byte limit to crash systems, targeting packet size validation rather than the fragment reassembly logic.
Concept tested: Teardrop attack and IP fragment reassembly exploit
Source: https://www.cisa.gov/uscert/ncas/tips/ST04-015
Topics
Community Discussion
No community discussion yet for this question.