mailing list archives
Re: More ssh fun (sshd this time)
From: wietse () WZV WIN TUE NL (Wietse Venema)
Date: Mon, 25 Aug 1997 18:48:33 -0400
[Reposted. The previous copy disappeared after being forwarded by
the listserv -- Wietse]
Ivo van der Wijk:
- This could also be considered a bug in bind(), because it doesn't wrap
portnumbers > 65536, but still, it makes sshd vurnerable, at least on Linux
(2.0.29), Solaris 2.4 and SunOs 4.1.4
Actually, the port number passed to bind() is a 16-bit quantity
(the sin_port member of a struct sockaddr_in).
The fix would be to compare nthos(foo.sin_port) with IPPORT_RESERVED.
By sheer dumb luck, this is exactly what I did in my hacked FTP daemon.