nhc.kp.txt

`  
-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
*IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII*  
* _,=wwmmm=,_ *  
* .,=#""" `"M>_ *  
* ,gP" "&_ M *  
* & ,d" M, ,R *  
* "k ,P "k {F *  
* W ,# Vk W *  
* '$ ,W M ,F *  
* M # ____ {$ M *  
* J$ ,[,,====,,,__ ___,<m#M""""""MM@_ W *  
* # MP',,====[[""""""""_,aP""""Mww_ M gF *  
* '& ,#`,#0" -^ -"""""""F '` 'M& $ ,W *  
* $ M gF "N.M,g$ *  
* l $jR '&QE]PMw *  
* ,,M#&"$ _,,_ M]1@ $ *  
* W 'PVLB g"'["Mmg ,W{MR jT *  
* W @V&"k ,#,#"""#["&_ ,@/M{` g *  
* W $pVk%k ,#"g*g@@"w"@+M=_ ,aBgP]W W *  
* $ &_MwM>,__,gP g'gM|{| "MMw["""""" gP M@ {k *  
* @ M@ MX5""""<mP,# {|{| %,""ww==g#' M *  
* 4k "" "MmwP` ,# {k & ]&==,_ ,pw ,W *  
* & ,my,,JgMMwM, @ Vk ,g" `"Mwwm" $/F *  
* "k {`"%`@w ?MMw=wg#@$P ,P <P @" *  
* "m==M "w "Q "0M#""M M W gW ,R *  
* {k Yk & ''0ww0 " {` W # *  
* $ 0 "k # ,R @ *  
* @ { B , {k W {* *  
* fk {L W # -, # g` ,P *  
* & # JR__f' "w,,B$gM_ _4* *  
* "w_MgwM#"M+,,,,,,,,# '""`'0m" *  
* "' '' `''' *  
* *  
*IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII*  
* _______ _____________ __ ___ ___ _____ _________ ____ __. *  
* \ \ \_ _____/ \ / \ / | \ / _ \ \_ ___ \| |/ _| *  
* / | \ | __)_\ \/\/ / / ~ \/ /_\ \/ \ \/| < *  
* / | \| \\ / \ Y / | \ \___| | \ *  
* \____|__ /_______ / \__/\ / \___|_ /\____|__ /\______ /____|__ \ *  
* \/ \/ \/ \/ \/ \/ \/ *  
* _________ .___________________.___. *  
* \_ ___ \| \__ ___/\__ | | *  
* / \ \/| | | | / | | *  
* \ \___| | | | \____ | *  
* \______ /___| |____| / ______| *  
* \/ \/ *  
* -*^*- http://www.newhackcity.net -*^*- *  
* -*^*- mailto:[email protected] -*^*- *  
*IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII*  
* *  
* advisory_id:20000504a.0 release_date:2000-05-04 *  
* *  
*IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII*  
* main_fracas: *  
* It is possible to cause a kernel panic on systems running NetBSD *  
* by sending a packet remotely with an unaligned IP Timestamp option. *  
* *  
* affected_configurations: *  
* NetBSD 1.4.x on SPARC and Alpha platforms were tested and found to be *  
* vulnerable. Any platform where a page fault is caused by an unaligned *  
* memory access should also be vulnerable. *  
* *  
* unaffected_configurations: *  
* NetBSD 1.4.x on arm32 and x86 platforms were tested and found to not *  
* panic. However, this is only because these (and a few other untested) *  
* platforms do not page fault on unaligned memory accesses. *  
* *  
* notification: *  
* This was originally reported to the NetBSD Security Alerts mailing list on *  
* March 1, 2000, which was before the release of NetBSD 1.4.2. *  
*IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII*  
* --<<instructions 4 reproduction>>-- *  
* *  
* 1. Download, compile, and install libnet. It can be obtained from *  
* http://www.packetfactory.net *  
* *  
* 2. Download and compile the ISIC suite of utilities. They are at *  
* http://expert.cc.purdue.edu/~frantzen *  
* *  
* 3. After compiling the isic utilities, run the following from your shell *  
* of choice: *  
* 'icmpsic -s source -d dest -r 31337 -k 218504 -p 218505' *  
* *  
* where source is the source IP address (spoofed addresses work just fine), *  
* and dest is the IP address of the NetBSD machine. *  
* *  
* NOTE: For whatever reason, Linux mangles this packet before sending it. We *  
* have found that it does work correctly when sent from FreeBSD x86, NetBSD *  
* x86, and NetBSD arm32. *  
* *  
* *  
* Result: *  
* On the vulnerable platforms tested (listed above), a kernel panic results *  
* from an unaligned memory access. Because of the ability to spoof the *  
* packet, and the relative small packet size, an attacker could easily *  
* crash many NetBSD machines on a given subnet with minimal effort. *  
*IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII*  
* w@rning: NO FLY ZONE *  
* *  
* Internet Clock Watchers, Int'l. - for providing machines to test on *  
* packetfactory.net - for "cool ass" utilities *  
* Mike Frantzen - for writing isic *  
* THG/FLT - WAREZ 4EVER!#% *  
* statik - his awesome record is @ http://www.onlinehiphop.com *  
* colt 45 - "garbage in, garbage out" *  
* humboldt, ca - need i say more *  
*IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII*  
* Is it the real, or is it m3m0r3x3d?! *  
  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.0.1 (GNU/Linux)  
Comment: For info see http://www.gnupg.org  
  
iD8DBQE5EUkzM+WP9Eauj+URAutUAKCHbk8bHLulWb9MoffVvpKvwKk4WgCeJqJF  
PYHYzKAVd8x6tOE+pNcSM6Q=  
=dEiA  
-----END PGP SIGNATURE-----  
  
  
  
`