In a nutshell, it is possible to crash, reboot or otherwise kill a large number of systems by sending a ping of a certain size from a
remote machine. This is a serious problem, mainly because this can be reproduced very easily, and from a remote machine. (During tests, my
machine in London, England has been crashed from a machine in Berkeley, California), and because the attacker needs to know nothing about
the machine other than its IP address. Be afraid. Since I started this page on the 21st October, over 18 major operating systems have
been found vulnerable.
It's very easy to exploit - basically, some systems don't like being pinged with a packet greater than 65536 bytes (as opposed to the
default 64 bytes). This bug is not limited to Unix, but is popping up on Macs, Netware, Printers, Routers... the list goes on. Patches are
coming out extremely fast - the award did go to the Linux community for getting a patch out within three hours (well, 2 hours 35 minutes 10
seconds if you must know), but Bill Webb from Telebit assures me that the Netblazer patch was out within two! OK, OK, you can share the
prize money... :-)
An IP datagram of 65536 bytes is illegal, but possible to create owing to the way the packet is fragmented (broken into chunks for
transmission). When the fragments are reassembled at the other end into a complete packet, it overflows the buffer on some systems, causing
(variously) a reboot, panic, hang, and sometimes even having no effect at all...
Most implementations of ping won't allow an invalid datagram like this to be sent. Among the exceptions are Windows '95 and NT, although
they are certainly not the only ones...