Re: bugtraq posts: stream.c - new FreeBSD exploit?

[Brett Glass]

Oops.... I've answered my own question. IPFW's "established" keyword
only checks the RST or ACK bits; it can't tell if a session is
REALLY established or not. Only a firewall that can save state
(such as IPFilters), or the kernel itself, can do this.

It'd be neat if we could use IPFilters to do a temporary fix for
this, because it'd nuke the problem on several OSes at once --
including all of the BSDs. (They all just happen to come with IPFilters
out of the box now.) This way, when the skript kiddies reading Bugtraq
start trying this, there will be an immediate defense.

--Brett



To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-stable" in the body of the message