Date: Wed, 3 Mar 2004 04:30:23 +1100 (Australia/ACT) From: Darren Reed <avalon@caligula.anu.edu.au> To: silby@silby.com (Mike Silbersack) Cc: freebsd-security@freebsd.org Subject: Re: mbuf vulnerability Message-ID: <200403021730.i22HUN1J025897@caligula.anu.edu.au> In-Reply-To: <20040302111509.E12133@odysseus.silby.com> from "Mike Silbersack" at Mar 02, 2004 11:18:01 AM
next in thread | previous in thread | raw e-mail | index | archive | help
In some mail from Mike Silbersack, sie said: > On Wed, 3 Mar 2004, Darren Reed wrote: > > > IPFilter v4 can prevent this attack with: > > > > pass in .. proto tcp ... keep state(strict) > > Nope, I just tested this. Well, I should say that it doesn't provide any > protection with "keep state"... what does (strict) mean? The ipf in > FreeBSD doesn't seem to support it. Uh, what did you test and what did you test with ? "strict" requires that the sequence number in packet n should match what that sequence number of the last byte in packet n-1 - i.e. no out of order delivery is permitted. Darren
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200403021730.i22HUN1J025897>