From owner-freebsd-hackers Thu Sep 3 14:30:51 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id OAA26508 for freebsd-hackers-outgoing; Thu, 3 Sep 1998 14:30:51 -0700 (PDT) (envelope-from owner-freebsd-hackers@FreeBSD.ORG) Received: from gatekeeper.tsc.tdk.com (gatekeeper.tsc.tdk.com [207.113.159.21]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id OAA26499 for ; Thu, 3 Sep 1998 14:30:48 -0700 (PDT) (envelope-from gdonl@tsc.tdk.com) Received: from sunrise.gv.tsc.tdk.com (root@sunrise.gv.tsc.tdk.com [192.168.241.191]) by gatekeeper.tsc.tdk.com (8.8.8/8.8.8) with ESMTP id OAA18627; Thu, 3 Sep 1998 14:29:43 -0700 (PDT) (envelope-from gdonl@tsc.tdk.com) Received: from salsa.gv.tsc.tdk.com (salsa.gv.tsc.tdk.com [192.168.241.194]) by sunrise.gv.tsc.tdk.com (8.8.5/8.8.5) with ESMTP id OAA06278; Thu, 3 Sep 1998 14:29:41 -0700 (PDT) Received: (from gdonl@localhost) by salsa.gv.tsc.tdk.com (8.8.5/8.8.5) id OAA04951; Thu, 3 Sep 1998 14:29:40 -0700 (PDT) From: Don Lewis Message-Id: <199809032129.OAA04951@salsa.gv.tsc.tdk.com> Date: Thu, 3 Sep 1998 14:29:40 -0700 In-Reply-To: Studded "Response to RST validation problem?" (Sep 3, 12:04pm) X-Mailer: Mail User's Shell (7.2.6 alpha(3) 7/19/95) To: Studded , freebsd-hackers@FreeBSD.ORG Subject: Re: Response to RST validation problem? Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Sep 3, 12:04pm, Studded wrote: } Subject: Response to RST validation problem? } As I'm sure everyone is aware, there was a post on bugtraq Sunday } regarding a vulnerability in our TCP code which leaves the system open } to attack via RST packets. In the past the project has always responded } within a few days to such problems, either with a fix or a progress } report on a fix. I have not seen such a response, therefore I'm asking } what progress is being made on this problem. There have been some patches posted to security. One was a mega-patch from me that fixes this as well as a few other problems. } According to Darren Reed the appropriate fix is already available in } NetBSD's code, so that might be a good place to start looking. :) The NetBSD code looks vulnerable to me. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message