Linux Kernel 2.2 - Predictable TCP Initial Sequence Number

                							

                source: http://www.securityfocus.com/bid/670/info

A vulnerability in the Linux kernel allows remote users to guess the initial sequence number of TCP sessions. This can be used to create spoofed TCP sessions bypassing some types of IP based access controls.

The function 'secure_tcp_sequence_number' in the file 'drivers/char/random.c' at line 1684 is used to generate the initial sequence number. It used the MD4 hash with a set of inputs to generate the new ISN. 

https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/19522.tar.gz