Date: Thu, 20 Jan 2000 16:43:13 -0800 (PST) From: dima@rdy.com (Dima Ruban) To: Brett Glass <brett@lariat.org> Cc: jamiE rishaw - master e*tard <jamiE@arpa.com>, Tom <tom@uniserve.com>, Mike Tancsa <mike@sentex.net>, freebsd-security@FreeBSD.ORG, freebsd-stable@FreeBSD.ORG, security-officer@FreeBSD.ORG Subject: Re: bugtraq posts: stream.c - new FreeBSD exploit? Message-ID: <200001210043.QAA57553@sivka.rdy.com> In-Reply-To: <4.2.2.20000120172607.0198f1e0@localhost> from Brett Glass at "Jan 20, 2000 05:32:03 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
Brett Glass writes: > At 02:09 PM 1/20/2000 , jamiE rishaw - master e*tard wrote: > > >I have a copy of this, which I am not giving out. I will probably > >fire one off to jkh for sanity, Terriffic! > >The problem is, the kernel already (from my understanding) drops bad ACKs > >pretty quickly. The thing is, tho, that it's kernel bound.. which means > >CPU.. so unless you have tons of extra CPU to spare, this attack will > >take your system to a "pause" until the attacker ceases. > > The name "stream.c" makes it sound like a local, not remote, DoS. Does No, it's remote. > it have to be done from inside the system to be effective? I would think Not necessarily. > that, if it came from the outside, it'd be harder to saturate the > victim. > > I can think of ways to filter this by adding some stuff to IPFW. I don't believe you can filter it. > > --Brett > -- dima To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200001210043.QAA57553>