FreeBSD 2.2.x (before 2.2.8R) can be attacked by a RST Denial of Service.
19 Oct. 1998
Summary
FreeBSD 2.2.x (unpatched version) was found to be vulnerable to a RST attack. This is due to FreeBSD's lack of checking the of the sequence numbers in the RST packet. A malicious user can terminate any connection between the FreeBSD server and a remote user.
FreeBSD 2.2.x unfortunately doesn't check to see if the RST packet that it receives is a valid RST packet, this means that it only checks to see whether the IP address and the IP port pairs match to an existing connection, without checking the packet's sequence number.
Because minimal information is needed, the system which is most vulnerable, are multi-usered systems, where users can run any of the following program: lsof, netstat, and systat -net (or similar), because they show the needed pairs for the attack.
The needed pair can be found also by trying to connect to the remote server, and checking for the returning port number (which is of course the "highest" port number used), and by this finding out that each port under this number can be used for an attack.
A BSD exploit code is attached below:
/* rst.c -- based on:
land.c by m3lt, FLC
crashes a win95 box
Ported by blast and jerm to 44BSD*/
