tcp exploit

As Theo stated on misc@, Cisco has got a HUGE problem: http://www.cisco.com/en/US/products/sw/iosswrel/ps1829/products_feature_guide09186a00800ad25b.html

Also check: http://www.uniras.gov.uk/vuls/2004/236929/index.htm

That link notes the source of the discovery and notes that a presentation will be given at CanSecWest which we've mentioned on undeadly in the past (starts tomorrow if you're in Vancouver).

well, having read through the thread on misc@ and the uk advisory, and not being an expert on anything, it's not as bad as it sounds for your obsd boxen, but pretty worrying for the rest of the net... basically, obsd already has some mechanisms that limit the risks (ie. randomization in port attributions, better sequence number generation etc.) the advisory specifically mentions BGP as the prime target, but even obsd's upcoming BGP implementation seems to contain mitigating factors with more to come post-release. this has to be seen in the context that even if you're running a secure all-obsd (or whatever) network locally or even across networks, somewhere upstream you're pretty sure to find vulnerable Cisco or other routing equipment. which pretty much leaves us all with the potential for very "secure" (read UNCONNECTED) networks ;) however, this is hardly surprising or new, as I for one have been seeing articles detailing/promising problems in Cisco BGP for quite some time now. perhaps it's also a good time to lobby management for replacing overpriced proprietary routing equipment with a nice Soekris or Via C3 running your favourite OS...

I think this is all part of Theo's master plan; Perfectly coinsiding with the release of OpenBSD 3.5. Aaah, the beauty of it all.