Date: Mon, 19 Apr 1999 14:35:24 -0400 (EDT) From: Robert Watson <robert@cyrus.watson.org> To: Poul-Henning Kamp <phk@critter.freebsd.dk> Cc: Paul Hart <hart@iserver.com>, Chris <freebsd@hiway1.exit109.com>, security@FreeBSD.ORG Subject: Re: poink and freebsd Message-ID: <Pine.BSF.3.96.990419143238.9273S-100000@fledge.watson.org> In-Reply-To: <19223.924546292@critter.freebsd.dk>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 19 Apr 1999, Poul-Henning Kamp wrote: > In message <Pine.BSF.3.96.990419115152.253A-100000@anchovy.orem.iserver.com>, Paul Hart writes: > >On Mon, 19 Apr 1999, Chris wrote: > > > >> id rather not post the source to the list, since this is how exploits > >> get distributed, and bad things occur. > > > >Well, so much for the full-disclosure so many of us value. Is this the > >same "poink" that was recently posted to Bugtraq? > > It sounds like, which means you have to be on same ethernet and what it > does is make it look like another machine is configured with same IP. > > Not a big threat for most people. His report suggests it does nasty things to -STABLE and -CURRENT, although off hand my response on seeing the bugtraq posting was exactly the same: arp is arp is arp is not so very evil. However, I have not tested it, and we've had one positive report of pain resulting from poink. I did not realize it was the same poink as the bugtraq one, as I had already dismissed it as "unlikely". The threat that did come to mind is the kernel message thing: syslogd appears to fsync the log after each message coming from the kernel. If someone can generate sufficient log messages, they can seriously consume disk i/o bandwidth. I discovered this the hard way when I stuck a bit too much debugging code into my tokens module. :) Now I just kill syslogd before doing anything resulting in a lot of kernel output. Since arp announcements do come from the kernel, I suspect lots could cause pain. But I would hope it wouldn't crash the machine. Anyhow, my crash boxes are all tied up right now (being crashed by other code, that is) so maybe someone out there could verify this? Robert N Watson robert@fledge.watson.org http://www.watson.org/~robert/ PGP key fingerprint: AF B5 5F FF A6 4A 79 37 ED 5F 55 E9 58 04 6A B1 Carnegie Mellon University http://www.cmu.edu/ TIS Labs at Network Associates, Inc. http://www.tis.com/ Safeport Network Services http://www.safeport.com/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.3.96.990419143238.9273S-100000>