From: Jaco Kroon <jaco@kroon.co.za>
To: linux-kernel@vger.kernel.org
Subject: ipt_ULOG.c
Date: Thu, 04 Sep 2003 22:32:31 +0200 [thread overview]
Message-ID: <3F57A15F.4050804@kroon.co.za> (raw)
There is a problem in ipt_ULOG.c on older kernel versions (2.4.18
confirmed).
The problem is with shifting and not shifting of the nl groups. This
has already been fixed in later versions (Version 2.4.21 if I'm not
mistaken). It is also fixed in the 2.5 and 2.6 series of the kernel.
This problem can be used to execute a DOS attack on vulnerable servers.
Vulnerable servers are those that makes use of the ULOG target in
netfilter with groups other than 1 (this just happens to work correctly
since the group 1 also happens to shift into 1). The other groups
causes kernel memory corruption and in just about all my test cases to
total system failure. This can be triggered remotely by using hping to
send a packet that will be logged by the ULOG target.
Also, not sure whether IPv6 is affected (I don't use it yet, so ...)
Jaco
reply other threads:[~2003-09-04 20:39 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3F57A15F.4050804@kroon.co.za \
--to=jaco@kroon.co.za \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome