From owner-freebsd-security  Sun Jun 22 00:08:07 1997
Return-Path: <owner-security>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id AAA14909
          for security-outgoing; Sun, 22 Jun 1997 00:08:07 -0700 (PDT)
Received: from godzilla.zeta.org.au (godzilla.zeta.org.au [203.2.228.19])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id AAA14901
          for <freebsd-security@FreeBSD.ORG>; Sun, 22 Jun 1997 00:08:03 -0700 (PDT)
Received: (from bde@localhost) by godzilla.zeta.org.au (8.8.5/8.6.9) id QAA23696; Sun, 22 Jun 1997 16:52:17 +1000
Date: Sun, 22 Jun 1997 16:52:17 +1000
From: Bruce Evans <bde@zeta.org.au>
Message-Id: <199706220652.QAA23696@godzilla.zeta.org.au>
To: danny@panda.hilink.com.au, msmith@atrad.adelaide.edu.au
Subject: Re: Simple TCP service can hang a system (fwd)
Cc: freebsd-security@FreeBSD.ORG
Sender: owner-security@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

>> I've noticed that inetd doesn't check the source port for the request
>> to UDP simple services (echo, time, chargen, daytime).
>
>(note that this is Linux).
>
>FreeBSD ships with these disabled :
>...
>... so if you turn them on, you ought to understand this already 8)

Even if you turn them on, the loopback problem has been fixed for years:

    RCS file: /a/ncvs/src/usr.sbin/inetd/inetd.c,v
    Working file: inetd.c
    ...
    ----------------------------
    revision 1.4
    date: 1994/12/21 19:08:45;  author: wollman;  state: Exp;  lines: +63 -17
    Disable UDP service looping attack.
    ----------------------------

The example program is a long way from compiling under FreeBSD.  Linux
apparently "cleaned up" the networking headers more than FreeBSD.

Bruce