Bugtraq mailing list archives
Mac OS X Signature
From: oogali () INTRANOVA NET (Omachonu Ogali)
Date: Wed, 3 May 2000 11:36:37 -0400
I've noticed that if you send a TCP packet with the acknowledgement (ACK) flag set, a remote machine running Mac OS X will send a TCP packet with the reset (RST) flag set and "tcp_close, during connect" in the packet payload. I don't have any machines to test with, this was noted on my webserver and tcpdump. -- snip -- 19:51:19.435963 XXX.XXX.XXX.XXX.49225 > XXX.XXX.XXX.XXX.80: R 2435394389:2435394414 (25) win 0 (ttl 242, id 48284) 0x0000 4500 0041 bc9c 0000 f206 7b68 d182 8e5b E..A......{h...[ 0x0010 d1c9 5f0a c049 0050 9129 2b55 0000 0000 .._..I.P.)+U.... 0x0020 5004 0000 7387 0000 7463 705f 636c 6f73 P...s...tcp_clos 0x0030 652c 2064 7572 696e 6720 636f 6e6e 6563 e,.during.connec 0x0040 74 t -- snip -- -- +-------------------------------------------------------------------------+ | Omachonu Ogali oogali () intranova net | | Intranova Networking Group http://tribune.intranova.net | | PGP Key ID: 0xBFE60839 | | PGP Fingerprint: C8 51 14 FD 2A 87 53 D1 E3 AA 12 12 01 93 BD 34 | +-------------------------------------------------------------------------+
Current thread:
- Re: IL0VEY0U worm, (continued)
- Re: IL0VEY0U worm Elias Levy (May 04)
- Alert: Listserv Web Archives (wa) buffer overflow Cerberus Security Team (May 03)
- Reminder: MaxClientRequestBuffer Marc (May 03)
- Internet Security Systems Security Advisory: Vulnerability in Quake3Arena Auto-Download Feature Aleph One (May 03)
- Alert: DMailWeb buffer overflow Cerberus Security Team (May 03)
- Security Bulletins Digest (fwd) Justin Tripp (May 04)
- Aladdin eToken 3.3.3.x Hardware USB Key Private Data Extraction Kingpin (May 04)
- Trend Micro InterScan VirusWall Remote Overflow NAI Labs (May 04)
- How we defaced www.apache.org Peter van Dijk (May 04)
- Re: IL0VEY0U worm Elias Levy (May 04)
- Mac OS X Signature Omachonu Ogali (May 03)
- Re: IL0VEY0U worm Elias Levy (May 05)
- Re: IL0VEY0U worm Elias Levy (May 04)
- Re: ILOVEYOU worm Jaanus Kase (May 04)