[5264] in bugtraq
Security hole in Linux TCP stack (2.1.53 and all the rest)
daemon@ATHENA.MIT.EDU (Superuser (Duncan Simpson))
Mon Sep 8 02:07:26 1997
Date: Sun, 7 Sep 1997 16:00:59 +0059
Reply-To: "Superuser (Duncan Simpson)" <root@IO.STARGATE.CO.UK>
From: "Superuser (Duncan Simpson)" <root@IO.STARGATE.CO.UK>
X-To: alan@gw4pts.ampr.org
To: BUGTRAQ@NETSPACE.ORG
Inspired by an article in phrack that checked for ports by using bugs
1) Send an ACK and FIN packet. If you get an RST the port is not listenning
2) Send an ACk and check the RST for ttl decrease or window expansion (either
means listenning)
I discovered another bug. If you send a packet with FIN but not ACK set then
Linux will disgard the packet if the port is listening and send RST if not.
This allows "sleath" port scanning... not good. May I suggest anyone who
sends a packet with ACK set to a listenning sockets gets an RST and a free
entry in the system log, complete with their IP address for convient emialing
of their ISP if they send a lot.
Duncan (-:
