知道了这一点，假设攻击者构造了一条IC MP回应消息，它的头中包含伪造的任意主机a的源地址，如192.168.2.2。

Knowing this, imagine that an attacker constructs an ICMP echo message containing the spoofed source address of some arbitrary Host a, such as 192.168.2.2, in its header.

youdao

这种攻击和Rails验证储存在cookie中的消息摘要有关，这个缺陷允许一个攻击者来决定伪造签名能够在什么时候通过验证。

Such an attack is related to how Rails verifies message digests in the cookie store and might allow an attacker to determine when a forged signature is partially correct.

youdao

这样就可以开始向空SOAP消息体里填充伪造的消息内容了，由于签名验证无误，那攻击者定义的任何一个操作都可以被有效地执行了。

The filling of the empty SOAP body with bogus content can now begin, as any of the operations denied by the attacker can be effectively executed due to the successful signature verification.

youdao