[31475] in bugtraq
Re: 11 years of inetd default insecurity?
daemon@ATHENA.MIT.EDU (Mike Tancsa)
Mon Sep 8 17:34:58 2003
Message-Id: <5.2.0.9.0.20030908134545.06dd9dd8@209.112.4.2>
Date: Mon, 08 Sep 2003 13:50:15 -0400
To: bugtraq@securityfocus.com
From: Mike Tancsa <mike@sentex.net>
Cc: 3APA3A@SECURITY.NNOV.RU
In-Reply-To: <434148437.20030906180822@SECURITY.NNOV.RU>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
At 06:08 PM 06/09/2003 +0400, 3APA3A wrote:
>The problem is, remote attacker can establish as much connections per
>minute as bandwidth allows... Now, guess how inetd reacts if more than
>256 connections received in one minute? It will disable service for next
>10 minutes to help attack to succeed. Of cause, this is documented.
>Interval is not configurable.
>
>something like
>
>Jul 23 15:27:10 host inetd[86]: ftp/tcp server failing (looping), service
>terminated
>
>will appear in logs... If connection is closed by attacker before
>service actually starts, IP address of attacker will never be logged.
>
>IV. Workaround
Hi,
On FreeBSD's inetd there is the -C option in conjunction with the -R option
-C rate
Specify the default maximum number of times a service can be
invoked from a single IP address in one minute; the default is
unlimited. May be overridden on a per-service basis with the
"max-connections-per-ip-per-minute" parameter.
-R rate
Specify the maximum number of times a service can be invoked in
one minute; the default is 256. A rate of 0 allows an unlimited
number of invocations.
You can run without either of these options, but then you risk a DoS from
resource starvation. e.g. invoke 1000 copies of ftpd and eat up all the
RAM/Swap etc. Its problematic either way, but at least you can mitigate
the effects somewhat if its a single host attacking.
---Mike
