- Test - lists.nanog.org

Fwd: stream.c - new FreeBSD exploit?
by Allan Carscaddon 21 Jan '00

21 Jan '00

Fresh from BUGTRAQ: >Approved-By: aleph1(a)SECURITYFOCUS.COM >Delivered-To: bugtraq(a)lists.securityfocus.com >Delivered-To: bugtraq(a)securityfocus.com >Date: Tue, 18 Jan 2000 14:44:38 -0800 >Reply-To: The Tree of Life <ttol(a)JAMES.KALIFORNIA.COM> >Sender: Bugtraq List <BUGTRAQ(a)SECURITYFOCUS.COM> >From: The Tree of Life <ttol(a)JAMES.KALIFORNIA.COM> >Subject: stream.c - new FreeBSD exploit? >X-To: bugtraq(a)securityfocus.com >To: BUGTRAQ(a)SECURITYFOCUS.COM >X-Loop-Detect: 1 > >I've been informed today by an irc admin that a new exploit is circulating >around. It "sends tcp-established bitstream shit" and makes the "kernel >fuck up". > >It's called stream.c. > >The efnet ircadmin told me servers on Exodus (Exodus Communications) were >being >hit and they managed to get a hold of the guy. When asked what was going >on, he just said "stream.c". > >When I talked to another person to ask if he had 'acquired' the source, he >said he wasn't going to give it out. I asked him if he had a patch for it, >and he replied "the fbsd team is working on it. No patch is available right >now." > >What's the importance of this? Major companies such as Yahoo >(www.yahoo.com) and others run freebsd. > >According to the irc admin, a simple reboot fixes it. "Your box reboots or >dies." He also stated, when asked if anything noticeable happened, that >"nothing unusual [happened]". > >The only log that he could provide was this one: > >---snip--- > >syslog:Jan 18 12:30:36 x kernel: Kernel panic: Free list empty > >---snip--- > >One thing of note: he also stated this happened on non-freebsd systems, >which is contrary to what the other person said, who was "under the >impression it was freebsd specific." > >I have the source, which I'm not going to post for 2-3 days (give time for >fbsd to work on the fix). If it isn't out before the 21st, I'll post it up. > >---snip--- > >void usage(char *progname) >{ > fprintf(stderr, "Usage: %s <dstaddr> <dstport> <pktsize> <pps>\n", >progname); > fprintf(stderr, " dstaddr - the target we are trying to attack.\n"); > fprintf(stderr, " dstport - the port of the target, 0 = random.\n"); > fprintf(stderr, " pktsize - the extra size to use. 0 = normal >syn.\n"); > exit(1); >} > >---snip--- > >Thanks for listening to my ramblings, hope everything I said helps. > >- ttol >http://www.alladvantage.com/home.asp?refid=AME389 >Get Paid to Surf. It works actually, cause people get thousands of dollars >a month from it...it's neet :P My id is AME389 - use it! :)

3 2

New form of packet attack named Stream
by Henry R. Linneweh 20 Jan '00

20 Jan '00

anyone have a preventative method for this? -- Thank you; |--------------------------------------------| | Thinking is a learned process so is UNIX | |--------------------------------------------| Henry R. Linneweh

4 3

NON-OP: Paintball and BBQ Outing Sunday B4 NANOG 18
by William B. Norton 20 Jan '00

20 Jan '00

Hi all - I've reserved the WoodStalk paintball field down in Santa Cruz for folks who are interested playing paintball *Sunday* Feb 6th (before NANOG) If previous paintball outings are any indication, it should be a blast! I can only take about 20 or so people, so in fairness I'll take folks on a first-come first-serve basis. The Game: For those who haven't played before, the basic paintball game is Capture the Flag but with paint ball guns. Once shot you are out of that 20 minute game. Logistics: To avoid car issues I have reserved transportation that will pick us up at 10:30AM sharp on Sunday at the Doubletree and take us to the field, returning us to the Doubletree around 3:30 or so. We'll fire up a BBQ for hamburgers, hot dogs, etc. The cost is $30 per person and I'll need to get a check/credit card deposit to hold spaces (sorry, otherwise the cancellation issues creep in). First time players are welcome: see http://www.woodstalk.com for details (you should bring a headband, hat, change of clothes, towel, etc.) If you want to reserve a spot, send me private e-mail. Invite people you'd like to shoot ;-) We'll fire up the burgers when we arrive and start the games at high noon. Hope to see you there - Bill

1 0

Fw: Administrivia: ORBS
by Sehmel, William C. 19 Jan '00

19 Jan '00

Got this from bugtraq. Bill Sehmel Peninsula School District Information Services Jr. Network Engineer. 253-857-8180 bsehmel(a)mail.peninsiula.wednet.edu -----Original Message----- From: Elias Levy <aleph1(a)SECURITYFOCUS.COM> To: BUGTRAQ(a)SECURITYFOCUS.COM <BUGTRAQ(a)SECURITYFOCUS.COM> Date: Wednesday, January 12, 2000 1:48 PM Subject: Administrivia: ORBS >It seems the folks at ORBS (orbs.org) have decided that since our mail >server its hosted of above.net, and above.net is filtering their >probes since they claim they are a DoS, ORBS is adding any mail servers >connected via above.net (including ours) to their spam relaying list, >regardless that our servers have never perform relaying functions. >I've emailed them but so far they have not responded. You may wish >to email them (orbs(a)orbs.org) and voice your dissatisfaction. >Of curse if our email to you is being blocked by ORBS then you will >probably not receive this message ;-) > >-- >Elias Levy >Security Focus >http://www.securityfocus.com/

22 61

Re: Fw: Administrivia: ORBS
by Martin Cooper 19 Jan '00

19 Jan '00

woods(a)most.weird.com (Greg A. Woods) wrote: > [ On , January 15, 2000 at 22:24:53 (-0800), Paul Vixie wrote: ] > > Subject: Re: Fw: Administrivia: ORBS > > > > So, Greg, have you stopped beating your wife? (Never mind.) > > Oh, boy, you were being a real asshole the other day.... > > I'll have you know that I didn't see this until today because I've been > in the hospital caring for my wife who fell and broke her ankle very > badly the other day. > > If I were an American I'd have your ass in court. But I'm not a > slandering inconsiderate bastard. Oh dear - I think you've misunderstood. "Have you stopped beating your wife?" is irony - the point being that you can't answer "Yes" or "No" without logically acknowledging that you have at some point beaten your wife, even if you haven't. You seem to want people to accept that imposing your will on other people without asking (allegory: "beating your wife") is ok in one context (ORBS scanning people's mail servers without asking), but not in another (spammers using people's mail relays without asking). The "I don't want anyone imposing their will on me without asking." option doesn't exist in your argument, just as the "I've never beaten my wife." option didn't exist in Paul's question. M.

2 1

Re: Fw: Administrivia: ORBS
by Paul Vixie 19 Jan '00

19 Jan '00

Just hit D now. Move along. There's nothing to see. I warned you. > So far AboveNet hasn't denied that there are/were open relays on "their" > networks either, at least not to my knowledge. Well, if they didn't deny it, then it MUST be true. Q.E.D. > All we know now is that > ORBS can no longer be used to prove that there are none remaining. So, Greg, have you stopped beating your wife? (Never mind.) > ORBS also maintains that they do not, nor have they ever, systematically > and preemptively scanned any networks. They also actively discourage > users of their web interface from doing such scanning and I've heard > second hand that they do in fact cut off access to the web interface > by anyone attempting such scans. Your second hand information differs significantly from mine. > Eg. even though my own network is assigned from a UUNET block, I am the > only one who owns the rights to receive packets at my IP addresses, or > indeed the right to block such packets (to the extent that packets to or > from my network don't cause some transit provider grief in the form of a > denial of service attack or such). You're assuming that packets with your IP address on either end of them are sacred in some way and have the right to pass unmolested on any wire no matter who pays for that wire or what their preferences are. I find that reasoning strikingly similar to what spammers say about THEIR traffic, and I'm starting to wonder why you are defending the efforts of an anti-spam organization (ORBS) if your ethical sympathies are all completely compatible with "theft of service"? > ... -- it should only be AboveNet's customers who have any > right to refuse service to anyone, not AboveNet themselves. So your provider ought not do anything about smurf attacks forged in your name, either? > That's certainly what I expect of my provider. I'm very happy that you have a choice of providers, and that you can find one who will sell you the kind of service you want. It sounds, though, as if you're not quite as happy that I have the same choice, or that I exercise it differently than you exercise yours. Why is that? > Your absolutely right on that > last point though -- AboveNet's customers can decide with their feet. > It won't be an easy decision though as in all other aspects AboveNet > seems to be a premium service. Gee, I wonder if there's a connection between this aspect and all others, or if the premium aspect is merely accidental or in spite of the blocking aspect? (HINT! That's a rhetorial question, the answer being "yes, there is a connection.") > > They are looking for port 25 on all addresses within /16'. You call it > > what you want, I'll call it a port scanner. > > Are they really? Can you prove it? ORBS and MAPS have a mutual nonaggression pact, which I'm skating near the edge of by entering this discussion at all. No, I won't be "proving it." -- Paul Vixie <vixie(a)mibh.net> >> But what *IS* the internet? > It's the largest equivalence class in the reflexive transitive > symmetric closure of the relationship "can be reached by an IP > packet from". --Seth Breidbart

4 3

Problems in Seattle/Northwest
by Sean Donelan 19 Jan '00

19 Jan '00

The northwest and seattle appear to be having a variety of problems. This weekend several people were killed in storms and downed power lines serving some 300,000 customers. Besides those problems, I've also noticed ongoing internet problems in the Northwest area since the weekend. It seemed concentrated to Sprint and UUNET, but I've had problems reaching sites in the Northwest with several providers sporadically. This is the first news story I've seen on the subject. http://www.seattlep-i.com/local/smrf18.shtml

1 0

Re: Fw: Administrivia: ORBS
by Paul Vixie 19 Jan '00

19 Jan '00

> Perhaps AboveNet would openly submit to testing by someone independent > of ORBS who would agree not to release the detailed results (except to > AboveNet) but who would check the validity of ORBS claims and provide a > summary report. ORBS would of course have to be allowed to review the > validity of the tests done. ORBS has made no claims that there are open relays inside Abovenet. They are preemptively scanning Abovenet's address space IN CASE THERE ARE ANY relays, either belonging to Abovenet, or belonging to an Abovenet customer. > In this case AboveNet is a transport provider and in my opinion they're > risking their status as a network carrier to be filtering in they way > they are. (Not that I know anything about carrier rights! :-). Right, like you said, YANAL. Abovenet also runs the MAPS RBL in BGP mode, and this hasn't hurt their status that I can tell from here. > Your own filtering of your own network when your own hosts are involved > is a much different scenario. It *is* Abovenet's own network. They sell transit to other people via their own network, but that doesn't change the ownership of Abovenet's network to somehow not include Abovenet. If you think Abovenet doesn't have the right to refuse service to anyone, then your property ethics are the same as any spammer's. And if Abovenet loses customers because they don't allow ORBS to probe them, then that's a matter for Abovenet's customers to decide. (MIBH uses the old Partan/Doran "maximum prefix length" filters on our BGP input side, which means we can't reach various nets who break up a /20 into a lot of discontiguous /24's each singly homed by a different transit provider. Do we, also, risk "losing our carrier status" because we exercise control over what routes and what traffic we carry?) > Finally can we please stop using the incorrect term "port scanner" here? > ORBS does not "scan" and it most certainly doesn't scan arbitrary ports. They are looking for port 25 on all addresses within /16'. You call it what you want, I'll call it a port scanner. -- Paul Vixie <vixie(a)mibh.net> >> But what *IS* the internet? > It's the largest equivalence class in the reflexive transitive > symmetric closure of the relationship "can be reached by an IP > packet from". --Seth Breidbart

4 4

Take Advantage .....
by kkgjfj6uur3d＠aol.com 18 Jan '00

18 Jan '00

INTERNATIONAL DRIVER'S LICENSE Need a new driver's license? Too many points or other trouble? Want a license that can never be suspended or revoked? Want ID for nightclubs or hotel check-in? Avoid tickets, fines, and mandatory driver's education. Protect your privacy, and hide your identity. The United Nations gave you the privilege to drive freely throughout the world! (Convention on International Road Traffic of September 19, 1949 & World Court Decision, The Hague, Netherlands, January 21, 1958) Take advantage of your rights. Order a valid International Driver's License that can never be suspended or revoked. Confidentiality assured. CALL NOW!!! 1-937-586-9313 rem- nypd55(a)angelfire.com

1 0

Re: Fw: Administrivia: ORBS
by Michael Shields 18 Jan '00

18 Jan '00

In article <Pine.LNX.4.10.10001152253220.17784-100000(a)pimlico.magmom.net>, Patrick Evans <pre(a)pre.org> wrote: > The only thing we can do which allows all of our customers to send > mail out with their address as the From: header, and not force them to > use our dialup service (if we had one) is to run a completely open > relay. I don't understand why you ca'n't allow relaying only for people with an envelope sender that has one of your customer's domains. -- Shields.

3 2