Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 19 Apr 1999 14:59:53 -0600
From:      Warner Losh <imp@harmony.village.org>
To:        Rodrigo Campos <camposr@MATRIX.COM.BR>
Cc:        Nicole Harrington <nicole@ispchannel.net>, security@FreeBSD.ORG, Liam Slusser <liam@tiora.net>
Subject:   Re: poink attack (was Re: ARP problem in Windows9X/NT) 
Message-ID:  <199904192059.OAA27640@harmony.village.org>
In-Reply-To: Your message of "Mon, 19 Apr 1999 16:51:57 -0300." <Pine.BSF.4.05.9904191643020.9049-100000@speed.matrix.com.br> 
References:  <Pine.BSF.4.05.9904191643020.9049-100000@speed.matrix.com.br>  

next in thread | previous in thread | raw e-mail | index | archive | help
In message <Pine.BSF.4.05.9904191643020.9049-100000@speed.matrix.com.br> Rodrigo Campos writes:
: I've tested the exploit against MacOS 8.5.1 and Solaris 7/i386, they both
: are vulnerable. The Solaris box just couldn't access anything outside its
: own network after that.

Define vulnerable.  APR has no security in it whatsoever[*], so there
is *NO* way to effectively defend against this attack w/o keeping a
database if NIC addresses in sync with IP addresses.  ARP does this
dynamically so you can swap out ethernet cards and the like w/o major
headache.

To work around this attack is fairly simple:  Just add arp entries by
hand (they will be permanant) when you boot your clients.

Warner

[*] Apart from the implicit trust of all machines on a physical wire.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199904192059.OAA27640>