TCP/IP SYN+FIN Packet Filtering Weakness

Tenable plugin 11618 fires when a host responds to a TCP segment that has both the SYN and FIN flags set simultaneously — an illegal flag combination that real TCP stacks should never emit. The original concern, documented by Uriel Maimon in *Phrack 49* (1996) and re-described in CVE-1999-0661 territory, was that early stateless packet filters and some ACL-based routers keyed their 'is this a new connection?' decision on the SYN bit alone, so an attacker could smuggle traffic past the filter by also setting FIN. The plugin checks the *host's* TCP stack behavior — does it accept the packet and reply — rather than the upstream filter, which is the actual issue. Affects: legacy BSD-derived stacks, some embedded TCP/IP implementations, and a long tail of network appliances; modern Linux (≥ 2.4), Windows (≥ XP SP2), and any iptables/nftables or stateful firewall with default rules drops these outright.

Tenable's MEDIUM rating is overstated for 2026 reality. There is no memory corruption, no auth bypass, no code execution — the worst-case outcome is that an attacker who is *already* able to send raw packets at your perimeter might evade a *stateless* ACL that you almost certainly aren't running. Anything past a 2005-vintage stateful firewall, any modern NGFW (Palo, Fortinet, Check Point, Cisco FTD), and the default Linux conntrack table all drop SYN+FIN. This belongs in the LOW / informational bucket on any honest risk register.

Why this verdict

• No primitive worth the name: the 'win' is bypassing a stateless filter to reach one port — nothing about the bug grants RCE, auth bypass, or info disclosure on the endpoint itself.
• Friction point — stateless filters are extinct: every NGFW, every cloud security group, and every default Linux conntrack policy drops SYN+FIN as INVALID. The bypass target essentially does not exist in 2026 enterprise architecture.
• Friction point — modern stacks reject the packet: Windows ≥ XP SP2, Linux ≥ 2.4, and macOS all refuse to process SYN+FIN. The vulnerable population is narrow legacy/embedded gear.
• Role multiplier — perimeter firewall: if the bug existed in your edge firewall's own stack, blast radius would still be 'evade one rule', not 'compromise the device' — the floor stays LOW.
• Role multiplier — ICS/OT controllers: some PLCs and HMIs do run legacy stacks that respond to SYN+FIN, but OT networks should be air-gapped or behind a dedicated firewall that drops the packet upstream; blast radius is contained to the OT segment, not fleet-wide.
• No KEV, no EPSS signal, no campaign telemetry: GreyNoise sees only research-grade SYN+FIN traffic. Threat actors moved on 20 years ago.

Why not higher?

MEDIUM would imply some realistic post-exploitation impact on a meaningful share of the installed base. Neither holds: the affected stack behavior gives the attacker no capability they don't already have if they can talk to the target, and the prerequisite stateless filter is a museum piece.

Why not lower?

Not IGNORE because legacy network appliances, embedded controllers, and OT gear genuinely do still ship with stacks that mishandle SYN+FIN, and a site running stateless ACL hardware (rare but extant in some carrier and SCADA environments) could see the documented evasion succeed. Document and clear at the next refresh cycle — don't pretend it's zero.

1. Drop INVALID-state TCP at the perimeter and host firewalls — On Linux edge devices: iptables -A INPUT -m conntrack --ctstate INVALID -j DROP (or nftables ct state invalid drop). On Windows hosts, Windows Defender Firewall already discards malformed flag combos by default — verify it is enabled. On NGFWs, confirm 'TCP flag validation' / 'strict TCP' is on. No mitigation SLA — implement at next change window.
2. Inventory legacy and embedded stacks — Use Nessus, Nmap (-O), or your CMDB to flag pre-2005 OS images, embedded appliances, printers, ICS controllers, and IP cameras. These are the only populations where plugin 11618 has any real teeth. Schedule them into the firmware/refresh program over the 365-day remediation window.
3. Enable IDS protocol anomaly rules — Suricata: keep stream-event:bad_syn enabled. Zeek: review weird.log for bad_TCP_checksum/SYN_with_FIN. This buys you detection in the unlikely event an attacker tries the technique.
4. Suppress the finding in your scanner with documented rationale — Mark Tenable plugin 11618 as accepted-risk on hosts that sit behind a verified stateful firewall. This reclaims dashboard attention for findings that matter.

Run from an auditor workstation with raw-socket capability (root or CAP_NET_RAW) against the target host. Requires hping3 and nmap. Invocation example: sudo ./check_synfin.sh 10.0.0.42 22. Exit 0 = PATCHED (host/firewall correctly drops SYN+FIN), exit 1 = VULNERABLE, exit 2 = UNKNOWN.

#!/usr/bin/env bash
# noisgate verifier: Tenable plugin 11618 — SYN+FIN filtering weakness
# Usage: sudo ./check_synfin.sh <target-ip> <tcp-port>
set -u

TARGET="${1:-}"
PORT="${2:-80}"

if [[ -z "$TARGET" ]]; then
  echo "usage: $0 <target> <port>" >&2
  exit 2
fi

if ! command -v hping3 >/dev/null 2>&1; then
  echo "UNKNOWN: hping3 not installed" >&2
  exit 2
fi

if [[ $EUID -ne 0 ]]; then
  echo "UNKNOWN: must run as root (raw sockets)" >&2
  exit 2
fi

echo "[*] Baseline SYN probe to ${TARGET}:${PORT}"
BASELINE=$(hping3 -c 3 -S -p "$PORT" "$TARGET" 2>/dev/null | grep -c 'flags=SA')

echo "[*] Sending SYN+FIN to ${TARGET}:${PORT}"
# -S SYN, -F FIN -> illegal SF flag combination
SYNFIN=$(hping3 -c 5 -S -F -p "$PORT" "$TARGET" 2>/dev/null | grep -c 'flags=SA')

echo "[*] Baseline SYN-ACK responses : ${BASELINE}"
echo "[*] SYN+FIN SYN-ACK responses  : ${SYNFIN}"

if [[ "$BASELINE" -eq 0 ]]; then
  echo "UNKNOWN: port appears closed/filtered to plain SYN; cannot compare"
  exit 2
fi

if [[ "$SYNFIN" -gt 0 ]]; then
  echo "VULNERABLE: host or upstream filter accepted SYN+FIN (plugin 11618 condition)"
  exit 1
fi

echo "PATCHED: SYN+FIN dropped (modern stateful behavior)"
exit 0

Sources

1. Tenable plugin 11618 detail
2. Phrack 49 — TCP/IP flag manipulation primer
3. CVE-1999-0661 (related SYN+FIN handling)
4. Linux netfilter conntrack INVALID state semantics
5. Suricata stream-events documentation (bad_syn / SYN with FIN)
6. RFC 793 — Transmission Control Protocol (flag semantics)
7. Nmap scan techniques — SYN/FIN flag scanning
8. Cisco IOS stateful inspection / established ACL behavior