- To: cert@cert.org, outages-list@eskimo.com
- Subject: Annex-3 Communications Server Exploit
- From: Robert Dinse <nanook@eskimo.com>
- Date: Sun, 13 Dec 1998 20:34:47 -0800 (PST)
- Resent-Date: Sun, 13 Dec 1998 20:34:56 -0800
- Resent-From: outages-list@eskimo.com
- Resent-Message-ID: <"_hBW73.0.o85.mL9Ts"@mx1>
- Resent-Sender: outages-list-request@eskimo.com
- Prev by Date: Seattle1 communications server reboot 8:45pm
- Next by Date: Denial of Service Attack
- Prev by thread: brief dial-up outage planned at around 11pm or so.
- Next by thread: Seattle1 communications server reboot 8:45pm
- Index(es):
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Annex-3 Communications Server Exploit
Someone hit us with some sort of a ICMP packet fragment reassembly exploit
that totally hangs Annex-3 communications servers.
If anybody knows the details of this exploit, and any easy fixes for it
(for example specific data in the IP packet that we might be able to catch in
router filters and block), it would be much appreciated.
Pertinent Information:
annex: stat
S/W Version: ANNEX3-UX X9.2.18 Build #2: Wed Sep 20 22:16:15 EDT 1995
H/W: Annex3 H/W Rev: 37. ROM Rev 0803.
Comm: eth-aui&twi/64asy/1par Mem: 4mDRM/64kEEPRM/64kSL1/64kSL2
Boot from: 204.122.16.13 Date: Sun Dec 13 20:33:43 1998 PST
Image: oper.42.enet Uptime: 17 mins
Inet addr: 204.122.16.25 Subnet mask: 255.255.255.0
Ethernet addr: 00-80-2d-01-95-40 Broadcast addr: 204.122.16.255
Default domain: eskimo.com