Possible PAWS security vulnerability

[Tim Traver]

Hello security gurus,

yesterday, I mistakenly posted a question on the questions list about 
this article :

http://www.securityfocus.com/bid/13676/info/

which talks about a form of DOS vulnerability.

I was curious as to the possibility of FreeBSD 5.x being affected, and 
if anyone was working on this or not.

Ted Mittelstaedt posted this possible patch based upon the OpenBSD patch :

in /usr/src/sys/netinet

*** tcp_input.c.original        Thu May 19 11:52:30 2005
--- tcp_input.c Thu May 19 12:00:14 2005
***************
*** 976,984 ****
--- 976,992 ----
                 * record the timestamp.
                 * NOTE that the test is modified according to the latest
                 * proposal of the tcplw at cray.com list (Braden 1993/04/26).
+                * NOTE2 additional check added as a result of PAWS vulnerability
+                * documented in Cisco security notice cisco-sn-20050518-tcpts
+                * from OpenBSD patch for OpenBSD 3.6 015_tcp.patch
                 */
                if ((to.to_flags & TOF_TS) != 0 &&
                    SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
+                       if (SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen
+
+                               ((thflags & (TH_SYN|TH_FIN)) != 0)))
+                                 tp->ts_recent = to.to_tsval;
+                       else
+                               tp->ts_recent = 0;
                        tp->ts_recent_age = ticks;
                        tp->ts_recent = to.to_tsval;
                }


After I basically let Ted know that I wouldn't know how to test the 
patch, because I don't even know how to break it in the first place, he 
went on a tirade calling me a troll, and all sorts of nasty accusations 
and general belittlement.

I hope that you don't have to work with him on a regular basis, because 
he appears to be the definition of the word "dickhead."

Tim.