[15092] in bugtraq
Re: Analysis of jolt2.c (MS00-029)
daemon@ATHENA.MIT.EDU (Darren Reed)
Sun May 28 16:27:27 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <200005262351.JAA23992@cairo.anu.edu.au>
Date: Sat, 27 May 2000 09:51:45 +1000
Reply-To: Darren Reed <avalon@COOMBS.ANU.EDU.AU>
From: Darren Reed <avalon@COOMBS.ANU.EDU.AU>
X-To: mikael.olsson@ENTERNET.SE
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <392E5D75.1E1A087A@enternet.se> from "Mikael Olsson" at May 26,
2000 01:18:13 PM
In some mail from Mikael Olsson, sie said:
[...]
> 2. Microsoft doesn't verify the checksum prior to storing it.
> Microsoft doesn't verify the structural integrity (the
> packet is truncated!)
[...]
I think it has been mentioned before that the MS TCP/IP code is
implemented in such a way that each of TCP, UDP, ICMP (and any
further protocol, such as IGMP?) have to do all their own sanity
checking of fragments, checksums, etc. I can only think that
they believe there is some performance benefit to be gained here.
Darren
