TCP/IP Sequence Prediction Blind Reset Spoofing DoS

Tenable plugin 12213 maps to CVE-2004-0230, the *Slipping in the Window* attack documented by Paul Watson in 2004. An off-path attacker who knows (or guesses) a TCP four-tuple — source/dest IP and port — can send a forged RST or SYN whose sequence number falls anywhere inside the receiver's window, killing the connection. The plugin fires against any host whose TCP stack accepts in-window RSTs without the stricter checks defined by RFC 5961 (challenge ACK, exact-match-only RST). Affected stacks are essentially every pre-2010 OS: legacy Windows (≤2003/XP SP2), older Linux (<2.6.36), older BSD, old Cisco IOS, JunOS, and a long tail of embedded/IoT/printer/UPS stacks that never got the RFC 5961 treatment.

Vendor severity MEDIUM is generous to the point of misleading on a modern fleet. The only impact is a *denial of service against an individual TCP connection* — not the host, not the service, not data. On any session protected by TLS, IPsec, or an application-layer keepalive/reconnect, the user sees a half-second hiccup. The plugin is famously noisy on long-lived BGP peerings (which is why TCP-MD5 / TCP-AO exist) and on legacy SCADA/serial-over-TCP gear. For a general enterprise fleet in 2026, this is backlog hygiene, not a patch event.

Why this verdict

• Impact is bounded to availability of one TCP connection — CVSS A:P with C:N/I:N. No code execution, no data loss, no privilege gain is reachable from this primitive.
• Mitigations are 16 years deployed. RFC 5961 landed in Linux 2.6.36 (2010), Windows 7, and every mainstream BSD/router OS. A modern fleet baseline catches this finding only on legacy outliers.
• The only historically painful target — BGP — is already protected by TCP-MD5/TCP-AO on every serious peering. The plugin firing on a BGP router today is almost always a false-positive for the keyed sessions.
• Role multiplier — line-of-business server / workstation: chain succeeds in dropping one TLS/SSH session; user reconnects. Blast radius: zero beyond a UX hiccup.
• Role multiplier — domain controller / identity provider: RFC 5961-compliant stack on all supported Windows; chain fails. Even if it landed, LDAP/Kerberos clients reconnect transparently. Blast radius: nil.
• Role multiplier — BGP edge router: chain succeeds only if TCP-MD5/AO is NOT configured AND the peer IP/port is guessable AND BCP38 is absent upstream. Outcome is a route flap, not compromise. Blast radius: brief reachability gap, capped at one peering.
• Role multiplier — OT/SCADA serial-over-TCP gateway: chain can succeed against ancient stacks and the dropped session may cause an HMI alarm or process trip. This is the only role where impact escapes 'cosmetic,' and even there it remains DoS — no control-plane takeover. Verdict floor does NOT cross HIGH because there is no integrity or RCE primitive.

Why not higher?

MEDIUM would imply meaningful business risk; the bug's impact is capped at a single TCP connection reset against a shrinking population of pre-2010 stacks. There is no path to code execution, credential theft, or lateral movement. Even in the worst high-value role (OT gateway), the outcome stays in the availability column.

Why not lower?

IGNORE would be wrong for OT/ICS environments and a small set of legacy network gear where a connection drop has real operational consequence, and where BCP38 + TCP-MD5 may not be in place. The finding deserves backlog hygiene attention, not deletion.

1. Enable TCP-MD5 or TCP-AO on every BGP peering — RFC 2385 / RFC 5925 reject any TCP segment not bearing the keyed digest, neutralizing this attack against the only deployment role where a connection reset has real business impact. Standard config on Cisco IOS/JunOS/Arista; no SLA — this should already be in place, audit by quarter-end.
2. Verify RFC 5961 is enabled on Linux fleet — Confirm net.ipv4.tcp_challenge_ack_limit is set (default since 2.6.36) and that no hardening profile has zeroed it. Push via Ansible/Puppet baseline. No mitigation SLA — fold into the next configuration baseline review.
3. Enforce BCP38 / uRPF at all internet edges — Drops spoofed-source packets before they reach internal stacks. Eliminates the off-path injection prerequisite for this and a dozen other spoofing-class attacks. Audit during your next firewall ruleset review.
4. Inventory and isolate pre-2010 TCP stacks — Embedded gear, printers, UPS, SCADA gateways, legacy Windows. Place behind segmentation so the four-tuple is not reachable from untrusted networks. Tracked in the asset inventory program, not a CVE SLA.
5. Suppress plugin 12213 on hosts confirmed RFC 5961-compliant — Tenable's plugin sometimes false-positives on stacks that ARE compliant but respond to crafted probes ambiguously. Document the suppression rationale per host class to keep the scan signal clean.

Run on a representative Linux host as a regular user — no privileges needed for the sysctl read. Example: ./check-rfc5961.sh. For Windows hosts, the equivalent is verifying OS build ≥6.1 (Windows 7 / Server 2008 R2) — anything older is end-of-life and inherently vulnerable. Outputs VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# noisgate verifier — CVE-2004-0230 / Tenable plugin 12213
# Checks for RFC 5961 (challenge ACK) support on a Linux host.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u

OS="$(uname -s)"
if [ "$OS" != "Linux" ]; then
  echo "UNKNOWN: this verifier targets Linux. For Windows, confirm build >= 6.1 (Win7/2008R2)."
  exit 2
fi

KVER="$(uname -r | awk -F. '{printf "%d%03d%03d\n", $1, $2, ($3+0)}')"
# RFC 5961 mitigations landed in 2.6.36
MIN="2006036"

if [ "$KVER" -lt "$MIN" ]; then
  echo "VULNERABLE: kernel $(uname -r) predates RFC 5961 (need >= 2.6.36)"
  exit 1
fi

# Confirm the challenge ACK limit sysctl exists and is non-zero
SCTL="/proc/sys/net/ipv4/tcp_challenge_ack_limit"
if [ ! -r "$SCTL" ]; then
  echo "UNKNOWN: kernel new enough but $SCTL not readable"
  exit 2
fi

LIM="$(cat "$SCTL" 2>/dev/null || echo 0)"
if [ "$LIM" -le 0 ]; then
  echo "VULNERABLE: tcp_challenge_ack_limit=$LIM (mitigation disabled)"
  exit 1
fi

# Optional: surface SACK / rst_in_window counters if available
if [ -r /proc/net/netstat ]; then
  SKIP=$(awk '/TCPACKSkippedChallenge/{f=1; next} f{print $0; exit}' /proc/net/netstat 2>/dev/null || true)
  [ -n "$SKIP" ] && echo "  (info) TCPACKSkippedChallenge counter row: $SKIP"
fi

echo "PATCHED: kernel $(uname -r), tcp_challenge_ack_limit=$LIM (RFC 5961 active)"
exit 0

Sources

1. NVD — CVE-2004-0230
2. Tenable plugin 12213
3. US-CERT VU#415294 (TCP RST attack)
4. RFC 5961 — Improving TCP's Robustness to Blind In-Window Attacks
5. RFC 2385 — TCP MD5 Signature Option (BGP protection)
6. RFC 5925 — TCP Authentication Option (TCP-AO)
7. Watson, *Slipping in the Window* (CanSecWest 2004)
8. CISA KEV catalog (not listed)