Vulnerability Development mailing list archives
Re: kernel panic [linux 2.2.19-7] on UDP scan CP4.1-SP5
From: Blue Boar <BlueBoar () thievco com>
Date: Wed, 14 Nov 2001 11:07:59 -0800
Would not the OS itself crash without the FW kernel module loaded whena UDP scan was initiated? When the machine is running without the FW active, it stays up fine.
Sounds like you answered your own question. :) All the evidence suggests that the fault is in the firewall code. If a KLM dies, it's perfectly capable of taking the kernel with it. At least when I've done it on Solaris.. I assume Linux is the same.
I've tried the -T Paranoid switch; the system crashes with the VERY FIRST UDP packet, regardless of which port it's sent to. I subsequently re-enabled icmp, as a "before last" implied rule... And I see this: Initiating UDP Scan against (64.80.176.11) 12:43:34.168842 nmap_source.58153 > fw_under_test.973: udp 0 12:43:34.274503 fw_under_test > nmap_source: icmp: 64.80.176.11 udp port 973 unreachable And that's the last packet I get from the machine.
Meaning it crashes? Seems strange, you'd think Checkpoint would have tried a UDP packet before they shipped... Can anyone else confirm the results?
If I run nslookup on nmap_source, set my server to fw_under_test, and attempt to resolve something (even though fw_under_test is not running a nameserver), the fw_under_test does not crash. It merely replies with udp port unreachable and stays up.
Must be something in particular with the conetns of the packet NMAP sends. BB
Current thread:
- kernel panic [linux 2.2.19-7] on UDP scan CP4.1-SP5 Yanek Korff (Nov 14)
- Re: kernel panic [linux 2.2.19-7] on UDP scan CP4.1-SP5 Blue Boar (Nov 14)
- Fw: kernel panic [linux 2.2.19-7] on UDP scan CP4.1-SP5 Scott Walker Register (Nov 14)
- <Possible follow-ups>
- Re: kernel panic [linux 2.2.19-7] on UDP scan CP4.1-SP5 ed . rolison (Nov 14)
- RE: kernel panic [linux 2.2.19-7] on UDP scan CP4.1-SP5 Yanek Korff (Nov 14)
- Re: kernel panic [linux 2.2.19-7] on UDP scan CP4.1-SP5 Olaf Kirch (Nov 14)
- RE: kernel panic [linux 2.2.19-7] on UDP scan CP4.1-SP5 Yanek Korff (Nov 14)
- Re: kernel panic [linux 2.2.19-7] on UDP scan CP4.1-SP5 Blue Boar (Nov 14)
- RE: kernel panic [linux 2.2.19-7] on UDP scan CP4.1-SP5 Yanek Korff (Nov 14)
- RE: kernel panic [linux 2.2.19-7] on UDP scan CP4.1-SP5 Yanek Korff (Nov 19)
- RE: kernel panic [linux 2.2.19-7] on UDP scan CP4.1-SP5 Scott Walker Register (Nov 27)
- RE: kernel panic [linux 2.2.19-7] on UDP scan CP4.1-SP5 Ron DuFresne (Nov 27)
- RE: kernel panic [linux 2.2.19-7] on UDP scan CP4.1-SP5 Scott Walker Register (Nov 27)
- RE: kernel panic [linux 2.2.19-7] on UDP scan CP4.1-SP5 Scott Walker Register (Nov 27)