From owner-freebsd-security@FreeBSD.ORG  Fri May 20 16:26:57 2005
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 19DF316A4CF
	for <freebsd-security@freebsd.org>;
	Fri, 20 May 2005 16:26:57 +0000 (GMT)
Received: from mail1.simplenet.com (mailer.simplenet.com [209.132.1.31])
	by mx1.FreeBSD.org (Postfix) with ESMTP id E15A343D60
	for <freebsd-security@freebsd.org>;
	Fri, 20 May 2005 16:26:56 +0000 (GMT)
	(envelope-from tt-list@simplenet.com)
Received: from [192.168.1.106] (24.25.210.244) by mail1.simplenet.com
	(7.0.016) (authenticated as tt@simplenet.com)
	id 428DA76C00000743 for freebsd-security@freebsd.org;
	Fri, 20 May 2005 09:26:57 -0700
Message-ID: <428E0FD2.3070200@simplenet.com>
Date: Fri, 20 May 2005 09:26:58 -0700
From: Tim Traver <tt-list@simplenet.com>
User-Agent: Mozilla Thunderbird 1.0 - [MOOX M3] (Windows/20041208)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: freebsd-security@freebsd.org
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Possible PAWS security vulnerability
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 20 May 2005 16:26:57 -0000

Hello security gurus,

yesterday, I mistakenly posted a question on the questions list about 
this article :

http://www.securityfocus.com/bid/13676/info/

which talks about a form of DOS vulnerability.

I was curious as to the possibility of FreeBSD 5.x being affected, and 
if anyone was working on this or not.

Ted Mittelstaedt posted this possible patch based upon the OpenBSD patch :

in /usr/src/sys/netinet

*** tcp_input.c.original        Thu May 19 11:52:30 2005
--- tcp_input.c Thu May 19 12:00:14 2005
***************
*** 976,984 ****
--- 976,992 ----
                 * record the timestamp.
                 * NOTE that the test is modified according to the latest
                 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
+                * NOTE2 additional check added as a result of PAWS vulnerability
+                * documented in Cisco security notice cisco-sn-20050518-tcpts
+                * from OpenBSD patch for OpenBSD 3.6 015_tcp.patch
                 */
                if ((to.to_flags & TOF_TS) != 0 &&
                    SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
+                       if (SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen
+
+                               ((thflags & (TH_SYN|TH_FIN)) != 0)))
+                                 tp->ts_recent = to.to_tsval;
+                       else
+                               tp->ts_recent = 0;
                        tp->ts_recent_age = ticks;
                        tp->ts_recent = to.to_tsval;
                }


After I basically let Ted know that I wouldn't know how to test the 
patch, because I don't even know how to break it in the first place, he 
went on a tirade calling me a troll, and all sorts of nasty accusations 
and general belittlement.

I hope that you don't have to work with him on a regular basis, because 
he appears to be the definition of the word "dickhead."

Tim.