Possible PAWS security vulnerability

From: Tim Traver (tt-list_at_simplenet.com)
Date: 05/20/05

  • Next message: Uwe Doering: "Re: Possible PAWS security vulnerability" 
    Date: Fri, 20 May 2005 09:26:58 -0700
To: freebsd-security@freebsd.org

    Hello security gurus,

    yesterday, I mistakenly posted a question on the questions list about
    this article :

    http://www.securityfocus.com/bid/13676/info/

    which talks about a form of DOS vulnerability.

    I was curious as to the possibility of FreeBSD 5.x being affected, and
    if anyone was working on this or not.

    Ted Mittelstaedt posted this possible patch based upon the OpenBSD patch :

    in /usr/src/sys/netinet

    *** tcp_input.c.original Thu May 19 11:52:30 2005
    --- tcp_input.c Thu May 19 12:00:14 2005
    ***************
    *** 976,984 ****
    --- 976,992 ----
                     * record the timestamp.
                     * NOTE that the test is modified according to the latest
                     * proposal of the tcplw@cray.com list (Braden 1993/04/26).
    + * NOTE2 additional check added as a result of PAWS vulnerability
    + * documented in Cisco security notice cisco-sn-20050518-tcpts
    + * from OpenBSD patch for OpenBSD 3.6 015_tcp.patch
                     */
                    if ((to.to_flags & TOF_TS) != 0 &&
                        SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
    + if (SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen
    +
    + ((thflags & (TH_SYN|TH_FIN)) != 0)))
    + tp->ts_recent = to.to_tsval;
    + else
    + tp->ts_recent = 0;
                            tp->ts_recent_age = ticks;
                            tp->ts_recent = to.to_tsval;
                    }

    After I basically let Ted know that I wouldn't know how to test the
    patch, because I don't even know how to break it in the first place, he
    went on a tirade calling me a troll, and all sorts of nasty accusations
    and general belittlement.

    I hope that you don't have to work with him on a regular basis, because
    he appears to be the definition of the word "dickhead."

    Tim.

    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

  • Next message: Uwe Doering: "Re: Possible PAWS security vulnerability"