Re: 2.1.96 EXPLOIT was [rootshell] Security Bulletin #18 (fwd)

David S. Miller (davem@dm.cobaltmicro.com)
Fri, 17 Apr 1998 21:22:55 -0700


Date: Fri, 17 Apr 1998 21:23:16 -0700 (PDT)
From: "Mr. James W. Laferriere" <babydr@nwrain.net>

On Fri, 17 Apr 1998, David S. Miller wrote:
> It's been fixed for 2 days, relax, here is a patch, it just hasn't
> made it's way into Linus's 2.1.x tree yet:

How about 2.0.33, or 'just apply it on 2.0.33 and be happy'
IE: It works on 2.0.33.

The patch I posted is for 2.1.x and won't apply to 2.0.33, for 2.0.33
you can use what Alan Cox posted to bugtraq or my "optimized" version
(which is running on vger right now). Alan will be rolling the fix
(either his or mine, at his discretion) into the 2.0.34 patch set:

--- net/ipv4/ip_fragment.c.~1~ Mon Dec 1 05:53:21 1997
+++ net/ipv4/ip_fragment.c Thu Apr 16 08:43:52 1998
@@ -369,7 +369,7 @@
memcpy(ptr, ((unsigned char *) qp->iph), qp->ihlen);
ptr += qp->ihlen;

- count = 0;
+ count = qp->ihlen;

/* Copy the data portions of all fragments into the new buffer. */
fp = qp->fragments;
@@ -396,7 +396,7 @@
/* Done with all fragments. Fixup the new IP header. */
iph = skb->h.iph;
iph->frag_off = 0;
- iph->tot_len = htons((iph->ihl * 4) + count);
+ iph->tot_len = htons(count);
skb->ip_hdr = iph;

ip_statistics.IpReasmOKs++;

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu