bugtraq - Smurfable Linux Kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 30 Mar 2006 14:16:38 +0100
From: Tomasz Chomiuk <t.chomiuk@...pl>
To: bugtraq@...urityfocus.com
Subject: Smurfable Linux Kernel

Hi list,

A couple of months ago I pointed out to the Linux Kernel networking 
maintainers an oversight which caused the kernel to be vulnerable to 
some form of smurf attack.

The problem lay in the kernel's inability to ignore icmp timestamp 
broadcast requests, thus IP networks with Linux boxes on board could 
lend themselves to possible DoS attacks.

The problem was fixed straight away and is now missing from the 2.6.13 
branch. Described misbehavior can now be controlled via 
icmp_echo_ignore_broadcasts sysctl.

- Tomek