lkml.org 
[lkml]   [2004]   [Sep]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRE: Linux 2.4.27 SECURITY BUG - TCP Local and REMOTE(verified)Denial of Service Attack
    From
    Date
    On Sul, 2004-09-12 at 19:40, Wolfpaw - Dale Corse wrote:
    > This bug also exists with Apache, the default config of SSH,
    > and anything controlled by inetd. This is the vast majority of
    > popular services on a regular internet server.. That is bad, no?

    I'm unable to duplicate any such problems with xinetd, or with thttpd,
    or with apache. Apache will wait a short time then timeout connections
    if you've configured it right. If you can continue making millions of
    connections a second you can DoS the server the other end, not exactly
    new news. The alternative is that you have an infinite number of running
    services and you run out of memory instead.

    Thats a high level property of any protocol which allows commitment of
    resource without being able to do the security authentication first. Its
    very hard to create ones that don't however, thus most devices in life
    (eg your telephone) have this form or DoS attack.

    My sshd also doesn't show this problem and the manual page indicates it
    has a 120 second grace timeout for authentication.

    The sshd manual page says:

    Gives the grace time for clients to authenticate themselves
    (default 120 seconds).


    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 14:06    [W:0.021 / U:239.720 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site