Re: [Fwd: Truth about ssh 1.2.27 vulnerabiltiy]

[Valdis.Kletnieks () VT EDU (Valdis.Kletnieks () VT EDU)]

On Thu, 30 Sep 1999 12:04:14 PDT, Eric Griffis <egriffis () COMMONTECH COM>  said:
> Also, I think the amount of processor time it takes to create a symbolic
> link is multiple times larger than the amount of time between the return of
> lstat and actual socket creation, which would require the sshd process to
> hang temporarily or be seriously slowed down. Is that feasible?
>
> How would these things be done, or is there something I missed? I'm very
> familiar with C and the unix environment, but the security-related aspects

cat >> slowmedown.c
main() { for(;;)}
^D
cc -o slowmedown slowmedown.c
for i in 1 2 3 4 5 6 7 8 9; do ./slowmedown &; done

Or apply yuor favorite fork bomb.  It's easy to slow things down as much as
needed - you get that load average up to 60 or 80 the window you're trying
to hit will get REAL wide.  I'f you're REALLY smart, you'll have all the
'slowmedown' processes trying to hit the window while they bog things down.


--
                                Valdis Kletnieks
                                Computer Systems Senior Engineer
                                Virginia Tech

<!-- attachment="bin0a00283" -->
<HR>
<UL>
<LI>application/pgp-signature attachment: stored
</UL>