Date: Mon, 19 Apr 1999 14:59:53 -0600 From: Warner Losh <imp@harmony.village.org> To: Rodrigo Campos <camposr@MATRIX.COM.BR> Cc: Nicole Harrington <nicole@ispchannel.net>, security@FreeBSD.ORG, Liam Slusser <liam@tiora.net> Subject: Re: poink attack (was Re: ARP problem in Windows9X/NT) Message-ID: <199904192059.OAA27640@harmony.village.org> In-Reply-To: Your message of "Mon, 19 Apr 1999 16:51:57 -0300." <Pine.BSF.4.05.9904191643020.9049-100000@speed.matrix.com.br> References: <Pine.BSF.4.05.9904191643020.9049-100000@speed.matrix.com.br>
next in thread | previous in thread | raw e-mail | index | archive | help
In message <Pine.BSF.4.05.9904191643020.9049-100000@speed.matrix.com.br> Rodrigo Campos writes: : I've tested the exploit against MacOS 8.5.1 and Solaris 7/i386, they both : are vulnerable. The Solaris box just couldn't access anything outside its : own network after that. Define vulnerable. APR has no security in it whatsoever[*], so there is *NO* way to effectively defend against this attack w/o keeping a database if NIC addresses in sync with IP addresses. ARP does this dynamically so you can swap out ethernet cards and the like w/o major headache. To work around this attack is fairly simple: Just add arp entries by hand (they will be permanant) when you boot your clients. Warner [*] Apart from the implicit trust of all machines on a physical wire. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199904192059.OAA27640>