Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   OS (UNIX)  >   Arp Vendors:   OpenBSD
(OpenBSD Issues Fix) Re: BSD arplookup() May Let Local Subnet Users Crash the System
SecurityTracker Alert ID:  1007881
SecurityTracker URL:
CVE Reference:   CVE-2003-0804   (Links to External Site)
Date:  Oct 5 2003
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): OpenBSD 3.3
Description:   A vulnerability was reported in the Mac OS X and other BSD-based operating systems. A remote user on a local subnet can consume all available operating system memory on the target system.

It is reported that a remote user on the local subnet can send a number of spoofed address resolution protocol (ARP) requests to the target system to cause kernel memory to become exhausted. As a result, denial of service conditions may occur. This is reportedly due to a flaw in the arplookup() function.

According to FreeBSD, various BSD-derived systems may be affected, as the vulnerable code dates well back to the CSRG branches.

Impact:   A remote user can cause the target system to crash.
Solution:   The following patch is available for OpenBSD 3.3:

Vendor URL: (Links to External Site)
Cause:   Resource error

Message History:   This archive entry is a follow-up to the message listed below.
Sep 23 2003 BSD arplookup() May Let Local Subnet Users Crash the System

 Source Message Contents

Subject:  OpenBSD ARP Flood

 > RELIABILITY FIX: October 1, 2003
 > It is possible for a local user to cause a system panic by flooding it with
 > spoofed ARP requests.  A source code patch exists which remedies the problem.


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC