Hi! This is the ezmlm program. I'm managing the
bugtraq@securityfocus.com mailing list.

I'm working for my owner, who can be reached
at bugtraq-owner@securityfocus.com.

Messages to you from the bugtraq mailing list seem to
have been bouncing. I've attached a copy of the first bounce
message I received.

If this message bounces too, I will send you a probe. If the probe bounces,
I will remove your address from the bugtraq mailing list,
without further notice.

I've kept a list of which messages from the bugtraq mailing list have
bounced from your address.

Copies of these messages may be in the archive.

To retrieve a set of messages 123-145 (a maximum of 100 per request),
send an empty message to:
<bugtraq-get.123_145@securityfocus.com>

To receive a subject and author list for the last 100 or so messages,
send an empty message to:
<bugtraq-index@securityfocus.com>

Here are the message numbers:

7792
--- Enclosed is a copy of the bounce message I received.
Return-Path: <>
Received: (qmail 24907 invoked from network); 22 Jan 2003 21:38:59 -0000
Received: from unknown (HELO mail.securityfocus.com) (205.206.231.9)
by lists.securityfocus.com with SMTP; 22 Jan 2003 21:38:59 -0000
Received: (qmail 23790 invoked by alias); 22 Jan 2003 21:55:14 -0000
Received: (qmail 20041 invoked from network); 22 Jan 2003 21:49:13 -0000
Received: from outgoing3.securityfocus.com (205.206.231.27)
by mail.securityfocus.com with SMTP; 22 Jan 2003 21:49:13 -0000
Received: by outgoing3.securityfocus.com (Postfix)
id 62698A4C15; Tue, 21 Jan 2003 11:39:49 -0700 (MST)
Date: Tue, 21 Jan 2003 11:39:49 -0700 (MST)
From: MAILER-DAEMON@outgoing3.securityfocus.com (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: bugtraq-return-7792-bugtraq=freebsd.csie.nctu.edu.tw@securityfocus.com
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="9243BA318F.1043174173/outgoing3.securityfocus.com"
Message-Id: <20030121183949.62698A4C15@outgoing3.securityfocus .com>

This is a MIME-encapsulated message.

--9243BA318F.1043174173/outgoing3.securityfocus.com
Content-Description: Notification
Content-Type: text/plain

This is the Postfix program at host outgoing3.securityfocus.com.

I'm sorry to have to inform you that the message returned
below could not be delivered to one or more destinations.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the message returned below.

The Postfix program

<bugtraq@freebsd.csie.nctu.edu.tw>: host
freebsd.csie.nctu.edu.tw[140.113.17.209] said: 550 Error: Message content
rejected (in reply to end of DATA command)

--9243BA318F.1043174173/outgoing3.securityfocus.com
Content-Description: Delivery error report
Content-Type: message/delivery-status

Reporting-MTA: dns; outgoing3.securityfocus.com
Arrival-Date: Mon, 6 Jan 2003 11:36:47 -0700 (MST)

Final-Recipient: rfc822; bugtraq@freebsd.csie.nctu.edu.tw
Action: failed
Status: 5.0.0
Diagnostic-Code: X-Postfix; host freebsd.csie.nctu.edu.tw[140.113.17.209] said:
550 Error: Message content rejected (in reply to end of DATA command)

--9243BA318F.1043174173/outgoing3.securityfocus.com
Content-Description: Undelivered Message
Content-Type: message/rfc822

Received: from lists.securityfocus.com (lists.securityfocus.com [205.206.231.19])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 9243BA318F; Mon, 6 Jan 2003 11:36:47 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 2396 invoked from network); 6 Jan 2003 02:40:05 -0000
From: "Yiming Gong" <yiming@security.zz.ha.cn>
To: <bugtraq@securityfocus.com>
Subject: ipfilter denial of service problem
Date: Mon, 6 Jan 2003 11:15:40 +0800
Message-ID: <001001c2b531$e43d1af0$f8ff1dda@penetrat>
MIME-Version: 1.0
Content-Type: text/plain;
charset="gb2312"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2627
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Importance: Normal

Below is an ipfilter security issue, and my previous mail to author
Darren was bounced back, so I think maybe I should mail it to this
mailing list.

Overview
--
Anytime ipfilter see a packet with ACK bit set without the previous SYN,
it will marked it as TCPS_ESTABLISHED in it's state table, and for
ipfilter will soon notice the RESET packet send back by the system
application, it will then change it's ttl in state table to 1 minute,OK,
it's good.

But If an attact send packet with ACK bit set and bad checksum, ipfilter
will happily add an "ESTABLISHED" session into it's state table which
will wait 120 hours to timeout instead of the normal 1 minutes!=20

So using this way an evil guy can easily destroy the network
connection of any system with ipfilter installed in a few minutes!


proof of concept
--
[yiming@security.zz.ha.cn]#hping -s ip.of.spoofedandtrusted.box -A
ip.of.target.box -p 22 -c 1 -b

you will immediately see a a long wait ttl of 120 hours, like this

security.zz.ha.cn,1235 server,22 4/0 tcp 1 40
119:59:48

Affected Versions:
--
I've test the following version of ipfilter

IP Filter: v3.4.30=20

IP Filter: v3.4.29 (400)


a chinese vesion of these security issue is at

http://security.zz.ha.cn=20

Best wishes!
=20
--=20
=CE=D2=D2=AA=B8=FC=BA=C3=B5=C4=C9=FA=BB=EE=20



Yiming Gong=20
Senior System Administrator=20
China Netcom
yiming@security.zz.ha.cn=20
http://security.zz.ha.cn=20
0086-371-7934907=20



--9243BA318F.1043174173/outgoing3.securityfocus.com--