Date:	Mon, 15 Feb 1999 09:33:56 +0100
From:	Dag-Erling Smorgrav <des@IFI.UIO.NO>
Subject:      Re: traceroute as a flooder
To:	BUGTRAQ@NETSPACE.ORG

Kris Kennaway <kkennawa@PHYSICS.ADELAIDE.EDU.AU> writes:
> On Sat, 13 Feb 1999, Alfonso De Gregorio wrote:
> > BTW, i've tested these bugs only on x86 boxes with the most diffused
> > GNU/Linux distro: Debian, Slackware, RedHat (all of them with 2.0.34 kernel),
> > and on an alpha with Digital Unix V4.0
> Just confirming that the first one seems to work on Digital Unix v3.2, and
> FreeBSD 4.0 as well (both using -w 2147483647). I didn't check the second one
> yet.

Fixed in FreeBSD 4.0-CURRENT, 3.1-STABLE and 2.2-STABLE as of now. The
upcoming 3.1-RELEASE (to be released later today) will not be vulnerable.

The attached patch should apply cleanly against most recent versions
of FreeBSD (2.2 and up). To update your system, try the following
(assuming you have the sources):

# cd /usr/src/contrib/traceroute
# patch traceroute.c <attached_patch
# cd ../../usr.sbin/traceroute
# make
# make install

DES
--
Dag-Erling Smorgrav - des@ifi.uio.no

Index: traceroute.c
===================================================================
RCS file: /home/ncvs/src/contrib/traceroute/traceroute.c,v
retrieving revision 1.5
retrieving revision 1.5.2.1
diff -u -r1.5 -r1.5.2.1
--- traceroute.c	1996/10/08 19:16:24	1.5
+++ traceroute.c	1999/02/15 08:24:08	1.5.2.1
@@ -732,6 +732,8 @@
 	wait.tv_sec = tp->tv_sec + waittime;
 	wait.tv_usec = tp->tv_usec;
 	(void)gettimeofday(&now, &tz);
+	if (wait.tv_sec < now.tv_sec + 1)
+		wait.tv_sec = now.tv_sec + 1;
 	tvsub(&wait, &now);

 	if (select(sock + 1, &fds, (fd_set *)0, (fd_set *)0, &wait) > 0)