On Mon, Jan 20, 2003 at 09:21:38AM -0500, David Bell wrote:
>
> Is FreeBSD vulnerable to the following, and if so is it being addressed?
>
> http://www.kb.cert.org/vuls/id/412115

Yes, many FreeBSD network drivers display this behavior. If you
followed any of the later discussion by the authors on several mailing
lists, FreeBSD was one of many OSes on which they duplicated the
problem.

As for whether the "vulnerability" is being addressed, this issue has
been known about for a long, long time, but has never been regarded as
a priority. The real security exposure here is quite small. The
cost of potentially breaking stuff and hurting performance has never
been seen to be worth the effort of a sweep. I personally am not aware
of a concerted effort to go through all of the Ethernet drivers to
zero out extra memory, but someone may be doing it... It's a bit of a
PITA and there is not a whole lot the Project can do about binary-only
drivers supplied by some vendors.

-- 
Crist J. Clark                     |     cjclarkalum.mit.edu
                                   |     cjclarkjhu.edu
http://people.freebsd.org/~cjc/    |     cjcfreebsd.org
To Unsubscribe: send mail to majordomoFreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]