Re: CVE-2008-4609

Andrew Storms <astorms@ncircle.com> writes:
> Now that the details are out - MS and Cisco patched today.  I went
> looking back into the FreeBSD security announcements and don't seem to
> be able to find any references for a patch.  Did FreeBSD already patch
> or discuss this bug and I missed it?

This is old news:

http://www.google.com/#&q=3Dsockstress

The initial version was just connection flooding - they thought it was a
big deal because they came up with a very clever and complicated setup
to increase the flood rate, when in fact a short C program using bpf
could have done the job just as well.  When people pointed out that it
was a load of bs, they started making wild claims about more serious
attacks, the details of which would be released at the next compsec
conference, except not really, because we're still working on it, but
the next one, we promise, for real this time...

Just read their website (http://www.sockstress.com/), it'll give you an
idea of just how far off their rocker they are.

DES
--=20
Dag-Erling Sm=C3=B8rgrav - des@des.no
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"