Date: Sun, 17 Dec 2000 01:20:07 -0800 From: Kris Kennaway <kris@FreeBSD.org> To: Poul-Henning Kamp <phk@FreeBSD.org> Cc: cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org, security-officer@FreeBSD.org Subject: Re: cvs commit: src/sys/netinet ip_icmp.c tcp_subr.c tcp_var.h Message-ID: <20001217012007.A18038@citusc.usc.edu> In-Reply-To: <200012161942.eBGJg7j93654@freefall.freebsd.org>; from phk@FreeBSD.org on Sat, Dec 16, 2000 at 11:42:07AM -0800 References: <200012161942.eBGJg7j93654@freefall.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--5vNYLRcllDrimb99 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Dec 16, 2000 at 11:42:07AM -0800, Poul-Henning Kamp wrote: > phk 2000/12/16 11:42:07 PST >=20 > Modified files: > sys/netinet ip_icmp.c tcp_subr.c tcp_var.h=20 > Log: > We currently does not react to ICMP administratively prohibited > messages send by routers when they deny our traffic, this causes > a timeout when trying to connect to TCP ports/services on a remote > host, which is blocked by routers or firewalls. This sounds like a security hole since ICMP messages don't have a TCP sequence number meaning they can be trivially spoofed - am I wrong? Kris --5vNYLRcllDrimb99 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE6PIVHWry0BWjoQKURAkZsAKCeb0CiaYfF1ABGgd9fOEovz5iyvQCgtQIS VoOHYgv+N0nlE8Q5RE4m54k= =6VAh -----END PGP SIGNATURE----- --5vNYLRcllDrimb99-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001217012007.A18038>