COMMAND
	FreeBSD routing table memory leak
SYSTEMS AFFECTED
	 FreeBSD 4.5-RELEASE
	 FreeBSD 4-STABLE after 2001-12-07 09:23:11 UTC
	 and prior to the correction date
	 Corrected: 2002-03-22 16:54:19 UTC (RELENG_4)
	            2002-04-15 17:12:08 UTC (RELENG_4_5)
PROBLEM
	In FreeBSD Security Advisory FreeBSD-SA-02:21.tcpip :
	 Background
	 ==========
	The TCP/IP stack's routing table records information about how to  reach
	various destinations. The first time a  TCP  connection  is  established
	with a particular host, a so-called "cloned route" entry for  that  host
	is automatically derived from one of the predefined routes and added  to
	the table. Each entry has a reference  count  that  indicates  how  many
	existing connections use that entry; when the  reference  count  reaches
	zero, the entry is removed from the table.
	 Problem Description
	 ===================
	A bug was introduced into ip_output() wherein the processing of an  ICMP
	echo reply message would cause a reference  count  on  a  routing  table
	entry to never be decremented. Thus, memory allocated  for  the  routing
	table entry was never deallocated.
	 Impact
	 ======
	This bug could be  exploited  to  effect  a  remote  denial  of  service
	attack. An attacker could cause new routing table entries (for  example,
	by taking advantage of TCP's route cloning behavior)  and  then  utilize
	this bug to cause the route entry  to  never  be  deallocated.  In  this
	fashion, the target system's memory can be exhausted.
SOLUTION
	 Workaround
	 ==========
	Use a packet filter (see ipf(8) or ipfw(8)) to deny ICMP echo messages.
	 Solution
	 ========
	1) Upgrade your vulnerable system to 4.5-STABLE, 4.5-RELEASE-p3, or  the
	RELENG_4_5 security branch dated after the respective correction dates.
	2) To patch your present system:
	a) Download the relevant patch from the location below, and  verify  the
	detached PGP signature using your PGP utility.
	
	[4.5-RELEASE,
	 4-STABLE between 2001-12-28 10:08:33 UTC and 2002-02-20 14:57:41 UTC]
	# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:21/tcpip.patch
	# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:21/tcpip.patch.asc
	
	b) Execute the following commands as root:
	
	# cd /usr/src
	# patch < /path/to/patch
	
	c)      Recompile      your      kernel      as       described       in
	http://www.freebsd.org/handbook/kernelconfig.html   and    reboot    the
	system.
	 Correction details
	 ==================
	The following list contains the revision numbers of each file  that  was
	corrected in FreeBSD.
	
	Path                                                             Revision
	  Branch
	- -------------------------------------------------------------------------
	sys/netinet/ip_icmp.c
	  RELENG_4                                                      1.39.2.16
	  RELENG_4_5                                                1.39.2.14.2.1
	sys/netinet/ip_mroute.c
	  RELENG_4                                                       1.56.2.4
	  RELENG_4_5                                                 1.56.2.3.2.1
	sys/netinet/ip_output.c
	  RELENG_4                                                      1.99.2.29
	  RELENG_4_5                                                1.99.2.24.2.1
	- -------------------------------------------------------------------------