[lkml]   [2004]   [Sep]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRE: Linux 2.4.27 SECURITY BUG - TCP Local and REMOTE(verified)Denial of Service Attack
    On Sul, 2004-09-12 at 19:40, Wolfpaw - Dale Corse wrote:
    > This bug also exists with Apache, the default config of SSH,
    > and anything controlled by inetd. This is the vast majority of
    > popular services on a regular internet server.. That is bad, no?

    I'm unable to duplicate any such problems with xinetd, or with thttpd,
    or with apache. Apache will wait a short time then timeout connections
    if you've configured it right. If you can continue making millions of
    connections a second you can DoS the server the other end, not exactly
    new news. The alternative is that you have an infinite number of running
    services and you run out of memory instead.

    Thats a high level property of any protocol which allows commitment of
    resource without being able to do the security authentication first. Its
    very hard to create ones that don't however, thus most devices in life
    (eg your telephone) have this form or DoS attack.

    My sshd also doesn't show this problem and the manual page indicates it
    has a 120 second grace timeout for authentication.

    The sshd manual page says:

    Gives the grace time for clients to authenticate themselves
    (default 120 seconds).

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:06    [W:0.021 / U:1.104 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site