OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq Archives: Re: explanation and code for stream.c issues

Re: explanation and code for stream.c issues


Subject: Re: explanation and code for stream.c issues
From: Tim Yardley (yardleyUIUC.EDU)
Date: Fri Jan 21 2000 - 11:42:24 CST


At 11:25 AM 1/21/2000, Tim Yardley wrote:
>stream.c issues
>
>---------------------------------------------------
>:: temp remedy (exec summary)
>---------------------------------------------------
>
>If you use ipfilter...
>
>-- start rule set --
>block in quick proto tcp from any to any head 100
>pass in quick proto tcp from any to any flags S keep state group 100
>pass in all
>-- end rule set --
>
>That will help you "stop" the attack, although it will still use some CPU
>though
>
>Note: If you use IPFW, there is no immediate way to solve this problem due
>to the fact that it is a stateless firewall. If you are getting attacked,
>then temporarily use ipfilter to stop it.
>
>Otherwise, wait for vendor patches.
>
>FreeBSD "unofficial patch" by Alfred Perlstein:
>http://www.freebsd.org/~alfred/tcp_fix.diff

<snip>

>-- start stream.c --

<snip>

> packet.tcp.th_flags = 0;

change this to a little different effect:

packet.tcp.th_flags = TH_ACK;

<snip>

/tmy

-- Diving into infinity my consciousness expands in inverse
    proportion to my distance from singularity

+-------- ------- ------ ----- ---- --- -- ------ --------+
| Tim Yardley (yardleyuiuc.edu)
| http://www.students.uiuc.edu/~yardley/
+-------- ------- ------ ----- ---- --- -- ------ --------+



This archive was generated by hypermail 2b27 : Fri Jan 21 2000 - 14:25:11 CST