-----BEGIN PGP SIGNED MESSAGE-----

                 NetBSD Security Advisory 1999-004
                 =================================

Topic:		traceroute can create untraceable packet floods
Version:	NetBSD 1.3.3 and prior; NetBSD-current until 19990217
Severity:	Unauthorized users can flood remote hosts with a forged
		source address.


Abstract
========

By feeding traceroute(1) with invalid arguments the time delay
between packets sent is set to zero resulting in all packets sent out
very fast, possibly flooding the remote host with packets containing
a false source address.


Technical Details
=================

When setting the wait time for each packet the argument was not
sanity checked possibly causing select(2) to return immediately
after sending out a packet instead of waiting for reply.  The
return value of a select(2) call was not properly checked causing
a flood of packets to be sent to the remote host.  This is
exacerbated by the fact that traceroute(1) allowed non-root users
to set the source address for these packets, allowing them to appear
to come from any address, possibly making it extremely difficult to
identify the real source of the flood.


Solutions and Workarounds
=========================

A patch is available for the NetBSD 1.3.3 source, which fixes the
above problems.  You may find this patch on the NetBSD ftp server:

    ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/19990217-traceroute

The patch contains details on how to apply it.  As a temporary measure,
you can allow only privileged users to run traceroute by disabling its
setuid bit:

    chmod u-s /usr/sbin/traceroute


Thanks To
=========

Thanks go out to the members of the Bugtraq mailing list where this
problem was first discussed.  Also, many thanks to Curt Sampson 
<cjs@NetBSD.ORG> who fixed the problem in NetBSD-current and to
Hubert Feyrer <hubertf@NetBSD.ORG> for the patch to NetBSD-1.3.3
and the coordination of this security advisory.


More Information
================

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.


Copyright 1999, The NetBSD Foundation, Inc.  All Rights Reserved.

$NetBSD: NetBSD-SA1999-004.txt,v 1.1 1999/02/28 00:45:56 mrg Exp $

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQCVAwUBNtiSnD5Ru2/4N2IFAQHN+gQAyRP/VTze3CFwM5HFkVv20IjIHnCYWuHH
s+QRhxukEXVgLJJ8w85WXoWSdKj8VPpsIZcZFOp5ceSLKc5IRL2U4k4ys/ChTNF7
/WOywEbZPkSljiaWTMAxwQpYhacEnFfAodc/ALsqSE61ZQTNU3k2ZFogfYZQDdZZ
fGLxyQtc3vs=
=lxzQ
-----END PGP SIGNATURE-----