Vulnerability Development mailing list archives

'non-rfc' compliant ping command in win98/win2k - or?


From: "knud_erik højgaard" <knudergud () hotmail com>
Date: Tue, 31 Jul 2001 17:44:48

i was just wondering, maybe someone else is able to shed light on the issue.

scenario:
1 cisco 677 with CBOS 2.3.0

a buncha PC's equipped with various OS'es and a TCP/IP stack.

Ping the cisco router with a packet exactly 65500 bytes in size, and it will die. Well known and documented bug afaik.

But - what are the differences in the ping command in the following OS'es ?

win95: router doesn't crash
win98: router crashes
winNT: router doesn't crash
win2K: router crashes
Linux: router doesn't crash, tried with hping2, no effect either.
*BSD : router doesn't crash

as you can see the bug can only be triggered by the ping command from win2k. So now i ask, in my usual novice way.

Whats the difference? why is it there? does the ping command in 98/2k send 'illegal' data along with the packets? or are the others misbehaving? I have no idea.. maybe you do.

cheers.


_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp


Current thread: