The debian-private mailing list leak, part 1. Volunteers have complained about Blackmail. Lynchings. Character assassination. Defamation. Cyberbullying. Volunteers who gave many years of their lives are picked out at random for cruel social experiments. The former DPL's girlfriend Molly de Blanc is given volunteers to experiment on for her crazy talks. These volunteers never consented to be used like lab rats. We don't either. debian-private can no longer be a safe space for the cabal. Let these monsters have nowhere to hide. Volunteers are not disposable. We stand with the victims.
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Denial-of-service attack against INETD. Redhat 4.X and others...

 > I recently discovered a problem with the "inetd" running on RedHat
 > Linux version 4.x that makes all services launched from inetd vulnerable
 > to a denial-of-service attack.  I obtained a copy of the inetd
 > source code, made changes to fix the problem, and am hereby releasing
 > those changes back to the public.

Because you decided to reformat and reindent the code, I can't find
the significant parts of your changes among the noise.

 > I have implemented changes to the inetd program that address this
 > problem, as follows:  The program still limits the number of services
 > that will be launched within a 60 second window, but it does so by
 > refusing to "accept()" new connections too rapidly.  The listening
 > socket is never closed, and users never get a "Connection refused"
 > error.  They just see a slower response.  

Um, have you actually tried this? If you make these changes, and then
connect-bomb a service, you'll still get ECONNREFUSED when the
listen() queue fills.

 > In the course of making this change, I discovered and fixed another 
 > small problem with inetd.  It used to be that inetd would sleep
 > (ignoring all connection attempts) for one second after receiving
 > any signal.  

I cannot find either this problem or your supposed fix for it.

 > The source code that I modified was obtained from the NetKit-B-0.08
 > package.  

This is "only" a year out of date. The current version of inetd can be
found in "netkit-base-0.10" on your favorite ftp site.

-- 
   - David A. Holland          | Number of words in the English language that
     dholland@eecs.harvard.edu | exist because of typos or misreadings: 381


--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-private-request@lists.debian.org . 
Trouble?  e-mail to templin@bucknell.edu .