Fw: [bugtraq] NetBSD Security Advisory 2004-006: TCP protocol and implementation vulnerability

[Jacques A. Vidrine]

On Thu, Apr 22, 2004 at 01:51:12PM +0200, Frankye - ML wrote:
[...]
> Additionally, the 4.4BSD stack from which NetBSD's stack is derived, did
> not even check that a RST's sequence number was inside the window. RSTs
> anywhere to the left of the window were treated as valid.
>
> The fact that this has gone unnoticed for so long is an indication that
> there have not been a large number of RST/SYN DoS attacks ocurring in the
> wild.

Hmm, is this the same issue that we corrected in 1998?  Certainly we
became aware of it because it *was* being exploited.

Cheers,
-- 
Jacques Vidrine / nectar at celabo.org / jvidrine at verio.net / nectar at freebsd.org