[VulnWatch] OpenBSD IPv6 remote kernel crash

From: Thor Larholm (vulnwatch.org_at_jscript.dk)
Date: 02/05/04

  • Next message: Peter Winter-Smith: "[VulnWatch] The Palace 3.x (Client) Stack Overflow Vulnerability" 
    To: <vulnwatch@vulnwatch.org>
Date: Thu, 5 Feb 2004 14:58:21 -0800

    Georgi Guninski posted an advisory on his site about a remote crash in the
    OpenBSD kernel caused by connecting with a small IPv6 MTU.

    http://www.guninski.com/obsdmtu.html

    The error was present in revision 1.81 of /src/sys/netinet6/ip6_output.c and
    is fixed in revision 1.82 ( 2004/02/04 08:47:41 ), you can see the colored
    diffs at

    http://www.openbsd.org/cgi-bin/cvsweb/src/sys/netinet6/ip6_output.c.diff?r1=text&tr1=1.81&r2=text&tr2=1.82&f=h

    OpenBSD administrators should pull the revised code from CVS and recompile
    their kernels.

    Regards

    Thor Larholm
    Senior Security Researcher
    PivX Solutions
    24 Corporate Plaza #180
    Newport Beach, CA 92660
    http://www.pivx.com
    thor@pivx.com
    Phone: +1 (949) 231-8496
    PGP: 0x5A276569
    6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569

    PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of
    Qwik-Fix <http://www.qwik-fix.net>

  • Next message: Peter Winter-Smith: "[VulnWatch] The Palace 3.x (Client) Stack Overflow Vulnerability"