Bugtraq mailing list archives
Re: Bug in connect() ?
From: hofmann () WPAX01 PHYSIK UNI-WUERZBURG DE (Frank Hofmann)
Date: Fri, 7 Mar 1997 20:14:33 +0100
I've done some tests with the connect example on HP/UX 10.01. The original first connected to port 23, shut it down and then connected to port 24. I found out only the port number the first connect is made to decides whether the system crashes or not; the second connect is required to trigger the crash, but the port connected to is unimportant. So the sequence connect XX -> shutdown XX,2 -> connect ?? crashes my HP/UX 10.01 box for XX out of { 21, 23, 79, 111, 113, 513, 514, 6000 }, but not other XX I've tried (anything from 1-120, 500-530 and some arbitrary other values). I haven't got running services on every port I've tested - can't say if that's important at the moment. I also can add HP/UX 10.20 to the list of affected systems (only tested the original 23-24 sequence). I'm gonna try some recent HP patches as I had one report that HP/UX 9.05 is vulnerable and one that it is not. Perhaps it's fixed and I'm missing the patch. Bye, Frank Hofmann
Current thread:
- Re: Bug in connect() ? Frank Hofmann (Mar 07)
- Re: Bug in connect() ? Frank Hofmann (Mar 10)
- Lynx/MSIE denial-of-service Doctor Who (Mar 10)
- Re: Lynx/MSIE denial-of-service Christopher Blizzard (Mar 10)
- SGI Security Advisory 19970301-01-P - IRIX 5.x and 6.x fsdump Aleph One (Mar 10)
- xterm segfaults from environment variables - too obvious David Luyer (Mar 10)
- Secuirty Hole In Older Perl Installs... Ken Robson (Mar 11)
- Re: xterm segfaults from environment variables - too obvious Alex Belits (Mar 11)
- Division of Privilege (DoP) - Potential Security Vulnerability Aleph One (Mar 11)
- runpipe v1.2 with security hole fix Aleph One (Mar 11)