Re: CVE-2019-5599 SACK Slowness (FreeBSD 12 using the RACK TCP Stack)

2019-07-05 Thread Shawn Webb
On Fri, Jul 05, 2019 at 07:52:32AM -0700, Dan Langille wrote: > > On Jul 5, 2019, at 6:40 AM, Shawn Webb wrote: > > > >> On Wed, Jul 03, 2019 at 10:18:12AM -0700, Gordon Tetlow wrote: > >> Sorry for the late response, only so many hours in the day. > > > > Completely understood. Thanks for takin

Re: CVE-2019-5599 SACK Slowness (FreeBSD 12 using the RACK TCP Stack)

2019-07-05 Thread Dan Langille
> On Jul 5, 2019, at 6:40 AM, Shawn Webb wrote: > >> On Wed, Jul 03, 2019 at 10:18:12AM -0700, Gordon Tetlow wrote: >> Sorry for the late response, only so many hours in the day. > > Completely understood. Thanks for taking the time to respond! > >> >>> On Tue, Jun 18, 2019 at 08:06:55PM -0400

Re: CVE-2019-5599 SACK Slowness (FreeBSD 12 using the RACK TCP Stack)

2019-07-05 Thread Shawn Webb
On Wed, Jul 03, 2019 at 10:18:12AM -0700, Gordon Tetlow wrote: > Sorry for the late response, only so many hours in the day. Completely understood. Thanks for taking the time to respond! > > On Tue, Jun 18, 2019 at 08:06:55PM -0400, Shawn Webb wrote: > > It appears that Netflix's advisory (as of

Re: CVE-2019-5599 SACK Slowness (FreeBSD 12 using the RACK TCP Stack)

2019-07-03 Thread grarpamp
>>> https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md >> discussion around disclosure policies > In today's world of parallel discovery, leaks, sec org infiltration by > adversary, surveillance, no crypto, rapid automated exploit, etc... > to wait for pa

Re: CVE-2019-5599 SACK Slowness (FreeBSD 12 using the RACK TCP Stack)

2019-07-03 Thread Gordon Tetlow
Sorry for the late response, only so many hours in the day. On Tue, Jun 18, 2019 at 08:06:55PM -0400, Shawn Webb wrote: > It appears that Netflix's advisory (as of this writing) does not > include a timeline of events. Would FreeBSD be able to provide its > event timeline with regards to CVE-2019-

Re: CVE-2019-5599 SACK Slowness (FreeBSD 12 using the RACK TCP Stack)

2019-07-03 Thread grarpamp
On 6/24/19, grarpamp wrote: > On 6/18/19, grarpamp wrote: >> https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md >> As it is not in the current .md, when was the issue >> discovered by Netflix / Looney? > > One week has gone by, so asking again... This is

Re: CVE-2019-5599 SACK Slowness (FreeBSD 12 using the RACK TCP Stack)

2019-06-24 Thread grarpamp
On 6/18/19, grarpamp wrote: > https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md > As it is not in the current .md, when was the issue > discovered by Netflix / Looney? One week has gone by, so asking again... When was the issue discovered by Netflix / L

Re: CVE-2019-5599 SACK Slowness (FreeBSD 12 using the RACK TCP Stack)

2019-06-18 Thread grarpamp
On 6/18/19, Gordon Tetlow wrote: > On Tue, Jun 18, 2019 at 05:34:32PM -0400, grarpamp wrote: >> https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md >> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5599 >> NFLX-2019-001 >> >> Date Entry Created: 20

Re: CVE-2019-5599 SACK Slowness (FreeBSD 12 using the RACK TCP Stack)

2019-06-18 Thread Shawn Webb
On Tue, Jun 18, 2019 at 04:55:35PM -0700, Gordon Tetlow wrote: > On Tue, Jun 18, 2019 at 05:34:32PM -0400, grarpamp wrote: > > https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md > > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5599 > > NFLX-2019-

Re: CVE-2019-5599 SACK Slowness (FreeBSD 12 using the RACK TCP Stack)

2019-06-18 Thread Gordon Tetlow
On Tue, Jun 18, 2019 at 05:34:32PM -0400, grarpamp wrote: > https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5599 > NFLX-2019-001 > > Date Entry Created: 20190107 > Preallocated to nothing? > Or w

CVE-2019-5599 SACK Slowness (FreeBSD 12 using the RACK TCP Stack)

2019-06-18 Thread grarpamp
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5599 NFLX-2019-001 Date Entry Created: 20190107 Preallocated to nothing? Or witheld under irresponsible disclosure thus keeping users vulnerable to l

Re: CVE-2019-5599: SACK Slowness (FreeBSD 12 using the RACK TCP Stack)

2019-06-18 Thread hiren via freebsd-security
On 06/18/19 at 04:36P, Stefan Bethke wrote: > https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md > > Are stock kernels/configurations affected? If so, will a fix or workaround be > incorporated? RACK is still not default stack so FreeBSD is not affected.

CVE-2019-5599: SACK Slowness (FreeBSD 12 using the RACK TCP Stack)

2019-06-18 Thread Stefan Bethke
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md Are stock kernels/configurations affected? If so, will a fix or workaround be incorporated? Thanks, Stefan -- Stefan BethkeFon +49 151 14070811 ___ fre