search for: csrg

On Sun, Oct 21, 2018 at 07:30:44PM +0200, Gert Doering wrote: > On Sun, Oct 21, 2018 at 10:21:56AM -0700, Parke wrote: > > On Sun, Oct 21, 2018 at 3:32 AM Timo Kilpilehto <timo at kilpilehto.fi> wrote: > > > eval sh -c "echo none of this makes any difference" > > > > Where is it documented that ssh is going to eval my command? The fact > >

...resses are sent in a small space of time, resource starvation can result, as the arplookup() function does not delete unnecessary ARP entries cached as the result of responding to an ARP request. NOTE WELL: Other BSD-derived systems may also be affected, as the affected code dates well back to the CSRG branches. III. Impact An attacker on the local network may be able to cause the system to hang or crash. The attacker must have physical access to the shared network medium. In the case of a wireless network obtaining this access may be trivial. Networks where proxy ARP is used to direct traff...

...resses are sent in a small space of time, resource starvation can result, as the arplookup() function does not delete unnecessary ARP entries cached as the result of responding to an ARP request. NOTE WELL: Other BSD-derived systems may also be affected, as the affected code dates well back to the CSRG branches. III. Impact An attacker on the local network may be able to cause the system to hang or crash. The attacker must have physical access to the shared network medium. In the case of a wireless network obtaining this access may be trivial. Networks where proxy ARP is used to direct traff...

...appropriately for the class the user is part of). login -h takes care of this when ssh is called for a regular login. To have access to the class when setting up the session, I had to add preserving it in ssh.c, and both version 1 and version 2 auth routines. I made that conditional on the last CSRG release BSD/OS is based on (all of the other BSD's should also have it). Please let me know if you have different suggestions. It looks like the s/key challenge/response code is really a hack using the debugging messages for the challenge on the first login attempt. It looked pretty painful...

...resses are sent in a small space of time, resource starvation can result, as the arplookup() function does not delete unnecessary ARP entries cached as the result of responding to an ARP request. NOTE WELL: Other BSD-derived systems may also be affected, as the affected code dates well back to the CSRG branches. III. Impact An attacker on the local network may be able to cause the system to hang or crash. The attacker must have physical access to the shared network medium. In the case of a wireless network obtaining this access may be trivial. Networks where proxy ARP is used to direct traff...

I had originally mentioned this only to 2 people, which was Jordan K. Hubbard and Paul Henning-Kemp, but since I have received a lot of queries on this, I thought I might as well post it on the FreeBSD announce groups. Included below is a posting done on the Linux-atm mailing group, by Pragnesh Sampat. I have just adapted for FreeBSD. RV -------------------------- Announcement

http://bugzilla.mindrot.org/show_bug.cgi?id=52 imaging at math.ualberta.ca changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #801 is|0 |1 obsolete| | ------- Comment #18 from imaging at math.ualberta.ca 2006-02-22 16:24

...resses are sent in a small space of time, resource starvation can result, as the arplookup() function does not delete unnecessary ARP entries cached as the result of responding to an ARP request. NOTE WELL: Other BSD-derived systems may also be affected, as the affected code dates well back to the CSRG branches. III. Impact An attacker on the local network may be able to cause the system to hang or crash. The attacker must have physical access to the shared network medium. In the case of a wireless network obtaining this access may be trivial. Networks where proxy ARP is used to direct traff...