The results of the fuzz testing for the ping utility from OpenBSD have been published, conducted after the recent discovery of a remotely exploitable vulnerability in the ping utility supplied with FreeBSD. The ping utility used in OpenBSD is not affected by the issue identified in FreeBSD (the vulnerability is present in the new implementation of the pr_pack() function, rewritten by FreeBSD developers in 2019), but during the inspection, another error emerged that had gone unnoticed for 24 years. This error leads to infinite looping when processing a response with a zero-length option field in the IP packet. The fix has already been included in OpenBSD. This issue is not considered a vulnerability, as the network stack in the OpenBSD kernel does not allow such packets to enter user space.
Forrás: opennet.ru
