Security hole in Linux TCP stack (2.1.53 and all the rest)

Superuser (root@IO.STARGATE.CO.UK)
Sun, 07 Sep 1997 16:00:59 +0059

Messages sorted by: [ date ][ thread ][ subject ][ author ]
Next message: Superuser: "sleath port scanning fix"
Previous message: Brian Mitchell: "procfs take II"

Inspired by an article in phrack that checked for ports by using bugs
1) Send an ACK and FIN packet. If you get an RST the port is not listenning
2) Send an ACk and check the RST for ttl decrease or window expansion (either
means listenning)

I discovered another bug. If you send a packet with FIN but not ACK set then
Linux will disgard the packet if the port is listening and send RST if not.
This allows "sleath" port scanning... not good. May I suggest anyone who
sends a packet with ACK set to a listenning sockets gets an RST and a free
entry in the system log, complete with their IP address for convient emialing
of their ISP if they send a lot.

Duncan (-:

Next message: Superuser: "sleath port scanning fix"
Previous message: Brian Mitchell: "procfs take II"