=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-


    Date: Ср, 27 окт 1999  01:14:01

   От: Boo Hampshire <drai2.geo@YAHOO.COM>

 Кому: VULN-DEV@SECURITYFOCUS.COM

 Тема: linux userland ip spoofing vulnerability

--------------------------------------------------------------------------------




There is code + documentation attached.



This works on linux 2.2.13 and is not related to the ip source forging

with pppd.



This works on systems with poor/no firewall setup, pppd + shell users. It

can forge a source address (on your local ethernet sent over ppp

interface).



This bug is caused by bind() in the kernel allowing you to send off

another interface.



No fix available but a workaround is to use your firewall to deny packets

that don't belong on a given interface (ipfwadm -W option, or whatever

ipchains is).