Possible DoS flaw in ppp

Marijn Meijles (marijn@stack.nl)
Wed, 8 Apr 1998 11:41:36 +0200


You wrote:
> On Wed, 25 Mar 1998, Jakob Borg wrote:
>
> > Hi... Found this file lying around claiming to exploit an IP overlapping
> > fragment bug found in "all linux kernels". ;) Said to be able to kill
> > Linux kernels... Is this something known? It seems far to serious not to
> > be known and/or fixed. Sorry to bother if that's the case.
> >
> > See attached code.
>
> It's an old file stick with the latest 2.0.x series and you will be fine.
> I've seen it used on my system a number of times :)
>
> Win 95 users are still screwed though, I have yet to see a working patch
> from MS that fixes it.
>
> Tells ya who is the best doesn't it? :)
>
Well, Linux can handle it, but sometimes the PPP link goes dead with all
these fragment overlapping exploits. It's highly erratic, so I can't give
much details, but it works upstream and downstream, resulting in possible
DoS attacks. There is nothing in the log files and when you kill pppd and
restart it, the link works again. Has anybody else experienced this? I run
2.0.33.
-- 
Marijn
---
Getting up is merely a stage of going to bed

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu