> Hi,
> 
> I may have discovered a bug in Redhat 6.2 (only) which could be used for
> a successful Denial Of Service attack.
> 
> Using the services "time" or "daytime" - which under 6.2 inetd.conf are
> both internal services - you can create a tcp connection that remains in
> the CLOSE_WAIT state. For example:
> 
> nc host.to.be.attacked.com 37
> 
> (telnet can also be used)
> 
> will return a binary value and then hang. Hit ^C and repeat.
> 
> Each one of these will leave a tcp connection in the CLOSE_WAIT state on
> the attacked host and no tcp connection on the attacking host.
> 
> After doing enough of these you can create enough tcp sessions on the
> attacked host so that any further tcp connections are no longer
> possible. This seems to only work on 6.2 and also requires time or
> daytime to be uncommented in /etc/inetd.conf.
> 
> I cannot find an existing patch for this and I thought it serious enough
> to bring to your attention and hopefully have a fast fix created by
> Redhat.
> 
> Thanks
> 
> Jim Palfreyman
> 
> Telstra - Networking Tasmania.
> 
>