Quote:
http://www.insecure.org/sploits/ping-o-death.html
Description: gazillions of machines can be crashed by sending IP packets that exceed the maximum legal length (65535 octets)
Author: The page included was created by Malachi Kenney. The programs have attribution.
Compromise: Stupid DOS
Vulnerable Systems: I have heard that NT and 95 can actually lock up hard from the programs below. Also, early 2.0.x Linux, Solaris x86, and Macintosh systems are often vulnerable.
Date: 21 October 1996 was when this page came up.
Notes: The Ping O' Death page is included first, then comes BSD source code, then comes a version of the above which is modified to compile on Linux 2.X. I also appended jolt.c, which IP spoofs to. Woop!
Also from the same source:
Quote:
In a nutshell, it is possible to crash, reboot or otherwise kill a large number of systems by sending a ping of a certain size from a
remote machine. This is a serious problem, mainly because this can be reproduced very easily, and from a remote machine. (During tests, my
machine in London, England has been crashed from a machine in Berkeley, California), and because the attacker needs to know nothing about
the machine other than its IP address. Be afraid. Since I started this page on the 21st October, over 18 major operating systems have
been found vulnerable.
It's very easy to exploit - basically, some systems don't like being pinged with a packet greater than 65536 bytes (as opposed to the
default 64 bytes). This bug is not limited to Unix, but is popping up on Macs, Netware, Printers, Routers... the list goes on. Patches are
coming out extremely fast - the award did go to the Linux community for getting a patch out within three hours (well, 2 hours 35 minutes 10
seconds if you must know), but Bill Webb from Telebit assures me that the Netblazer patch was out within two! OK, OK, you can share the
prize money... :-)
An IP datagram of 65536 bytes is illegal, but possible to create owing to the way the packet is fragmented (broken into chunks for
transmission). When the fragments are reassembled at the other end into a complete packet, it overflows the buffer on some systems, causing
(variously) a reboot, panic, hang, and sometimes even having no effect at all...
Most implementations of ping won't allow an invalid datagram like this to be sent. Among the exceptions are Windows '95 and NT, although
they are certainly not the only ones...
The artical goes on to explain why just blocking this at the firewall is not the best solution, and what systems are succeptable to this form of attack.