5 ms·

Larry and the “Ping of Death” (2007)

59 points by yuhong 12y ago

yuhong 12y ago
Do anyone remember which kind of bug this was?
- gvb 12y ago
  Sending a packet that exceeded the 65535 byte maximum packet size (via fragmentation and reassembly). This would cause a reassembly buffer overflow. http://en.wikipedia.org/wiki/Ping_of_death http://en.wikipedia.org/wiki/Ping_of_death
  - yuhong 12y ago
    I am talking about the exact bug talked about in the article I linked.
    - bcbrown 12y ago
      Given that it exposed a bug in a driver Larry wrote, years before the OS was released, likely only Larry knows what the bug was.
jes 12y ago
I disagree with Larry when he refers to that situation as a "moment of utter stupidity." People are not omniscient. I think it was classy, however, to apologize for the problem.
- kevan 12y ago
  Agreed. Everyone makes mistakes, owning up to them shows maturity. Sidenote: I'd much rather find out about something like this before release than have someone exploit it in the wild and force a patch.
- stefs 12y ago
  > And 15 years later, I'm still apologising for that one moment of utter stupidity. this sounds so incredibly strange to me - as if uncovering a supercritical bug is something you should be ashamed of. well, except if he introduced that bug himself, but still, buffer overflows weren't exactly a rare occurrence back then. a couple of hours of work lost now vs. years of work lost later ...
cek 12y ago
Before "Ping of Death" there was "Beeping Death" at Microsoft and Larry was involved well. http://blogs.msdn.com/b/larryosterman/archive/2005/11/09/490869.aspx http://blogs.msdn.com/b/larryosterman/archive/2005/11/09/490... And then there was the time Todd Laney took the entire corporate network down by streaming songs using multi-cast UDP...
cafard 12y ago
Back in the 1990s, CACM carried an analysis of UNIX programs' robustness against malformed inputs. The authors were motivated to do the study after noise on a modem connection had crashed jobs they were running. Their conclusion was that the robustness wasn't what it should be. I think that DEC's variant tested best of all.
- antientropic 12y ago
  A later, expanded version of the study found the GNU utilities to be the most robust: ftp://ftp.cs.wisc.edu/paradyn/technical_papers/fuzz-revisited.pdf
yuhong 12y ago
Even later, it was trivial to crash NT4 DNS server: http://support.microsoft.com/kb/162927 http://support.microsoft.com/kb/162927 http://support.microsoft.com/kb/169461 http://support.microsoft.com/kb/169461

59 points by yuhong 12y ago

yuhong 12y ago

Do anyone remember which kind of bug this was?

gvb 12y ago
Sending a packet that exceeded the 65535 byte maximum packet size (via fragmentation and reassembly). This would cause a reassembly buffer overflow. http://en.wikipedia.org/wiki/Ping_of_death http://en.wikipedia.org/wiki/Ping_of_death
- yuhong 12y ago
  I am talking about the exact bug talked about in the article I linked.
  - bcbrown 12y ago
    Given that it exposed a bug in a driver Larry wrote, years before the OS was released, likely only Larry knows what the bug was.

jes 12y ago

I disagree with Larry when he refers to that situation as a "moment of utter stupidity." People are not omniscient. I think it was classy, however, to apologize for the problem.

kevan 12y ago
Agreed. Everyone makes mistakes, owning up to them shows maturity. Sidenote: I'd much rather find out about something like this before release than have someone exploit it in the wild and force a patch.
stefs 12y ago
> And 15 years later, I'm still apologising for that one moment of utter stupidity. this sounds so incredibly strange to me - as if uncovering a supercritical bug is something you should be ashamed of. well, except if he introduced that bug himself, but still, buffer overflows weren't exactly a rare occurrence back then. a couple of hours of work lost now vs. years of work lost later ...

cek 12y ago

Before "Ping of Death" there was "Beeping Death" at Microsoft and Larry was involved well. http://blogs.msdn.com/b/larryosterman/archive/2005/11/09/490869.aspx http://blogs.msdn.com/b/larryosterman/archive/2005/11/09/490... And then there was the time Todd Laney took the entire corporate network down by streaming songs using multi-cast UDP...

cafard 12y ago

Back in the 1990s, CACM carried an analysis of UNIX programs' robustness against malformed inputs. The authors were motivated to do the study after noise on a modem connection had crashed jobs they were running. Their conclusion was that the robustness wasn't what it should be. I think that DEC's variant tested best of all.

antientropic 12y ago
A later, expanded version of the study found the GNU utilities to be the most robust: ftp://ftp.cs.wisc.edu/paradyn/technical_papers/fuzz-revisited.pdf

yuhong 12y ago

Even later, it was trivial to crash NT4 DNS server: http://support.microsoft.com/kb/162927 http://support.microsoft.com/kb/162927 http://support.microsoft.com/kb/169461 http://support.microsoft.com/kb/169461