The Ping o' Death Page Diary

• Well, I've left it as long as I can. I'm heading off to Africa in 3 weeks for a year or so Backpacking. Consequently, the Ping o'Death is not going to be foremost in my mind, and I'm looking for someone to take over the maintenance of these pages. There was a time a few months ago when I was getting swamped, but now I'm down to about 10-15 messages a week - a good number of which are "I can't crash my Windows '95 machine, what am I doing wrong". Any volunteers? Think of the publicity, the good will, the sex appeal... as always, mail me.
• AXIS have tested their products and found the everything OK. Specifically, all their Printservers, "StorPoint" CD-Servers and "NetEye" Camera Servers are fine.
• Solaris x86 patches are now officially out. For Solaris x86 v2.5 (Patch ID# 103170-10) see http://access1.sun.com/patch.recommended/2.5_x86.html. For Solaris x86 v2.5.1 (Patch ID# 103631-05) see http://access1.sun.com/patch.recommended/2.5.1_x86.html. No patch is available for v2.4

• SCO have patches out for their OpenServer 5. The patch is oss449a and can be downloaded here. The description of the patch is available as well.
• The patches mentioned below for SGI are available at ftp://sgigate.sgi.com in the Patches/5.3 or Patches/6.2 directories. The patch numbers are 1529 for 5.3 and 1418 for 6.2
• Everyone with newer DEC Unix installations, the recently released 4.0b has been made safe from the POD.
• For those of you wanting to trace the POD on your networks, a company calling themselves the AG Group manufacture a program called Etherpeek that will keep an eye on your network for any dodgy packets.
• Apparently there is a DOS app called pdclkset/pdtest written by a guy in Sweden that will send arbitrarily large ICMP requests. It's used to stress test ethernets to make sure everything is working properly. Anyway, it looks like this may cause similar problems, as it has been seen to cause Synoptics hubs to reset. I haven't got any more information on this, but it seems related so I thought I'd pass it on.
• Some of my information on the availability of patches for Solaris x86 is out of date - the patch for Solarix x86 2.5 is no longer temporary - it was released on the 6th December and can be downloaded here.
• Cabletron have been asked how there products fare against the Ping O'Death, and the say that there are no troubles. I guess we have to assume this applies to all there products

• SGI have released patches for the Ping O'Death and the SYN flood. Patches are available for both 5.3 and 6.2. I can't tell from looking at the advisory whether v6.2 is vulnerable to the ping or just the SYN flood, but I guess it doesn't matter much now. Follow the link for the advisory notice.
• The Shiva Lanrover is also secure. Like some of the other Shiva products, a message pops up in the Activity log saying "IP reassembly failed, length 65555". This may be something to watch for... The version tested was running ShivaOS v4.0, VRAM v5.6.0 and Hardware Revision 1.
• Well, got as little more information from SCO. It appears that the Ping O'Death for SCO systems is hardware dependent. Certain cards, such as the NE2000 and the SMC cards are vulnerable, while other cards are not - sorry, that's all the information I have. SCO are testing a patch and should release shortly.
• It seems that the very recent Service Pack 2 for NT 4.0 now prevents punters from sending invalid packets - ping responds with an "invalid size for option -l".
• Minix v2.0 is vulnerable.
• The ACC Danube router which was vulnerable is running version 8.0.7. Apparently ACC will not upgrade firmware without a fee being paid!

• The CERT advisory which has just come out lists several products which I didn't have information on before. Some have patches, some don't. Where the information I have had previously has been found incorrect, this is highlighted in red, and made italic for those of you browsing in black 'n' white.

  The systems with patches available are:

  • Digital Ultrix 4.3 to 4.5 (Presumably versions prior to 4.3 are also vulnerable, but patches are not available as these are no longer supported
  • Digital OpenVMS for VAX - vulnerable in the same way as Ultrix. Previously it was thought that only OpenVMS for AXP was in danger, but this is no longer the case.
  • Digital Unix MLS+ Version 3.1a
  • Digital Firewall for Unix and Digital AltaVista Firewall for UNIX
  • Digital VAX/ELN
  • IBM Secure Network Gateway Firewall
  The systems without patches available are:
  • SCO Internet FastStart
  • SCO OpenServer 5.0.0, 5.0.2
  • SCO Open Desktop 3.0
  • SCO TCP/IP 1.2.1 for SCO Unix System V/386 Release 3.2 Version 4.2
  • SCO Unix System V/386
  While new entries on the safe OS list are NEC EWS/UX, UP/UX and UX/4800.

  Rather than reproduce the information here, I could do no better than point you towards the original CERT Advisory for the full picture on the systems listed above.

• It seems that Netware 3.11 and 3.12 can be saved from the Ping o'Death by applying the TCPN02 patch... Can anyone confirm this before I move it into the "Vulnerable with Patches" section?
• Cisco are very puzzled over the problem with their 4000 router, as they are sure that it's OK... I'm moving it to a "just might be vulnerable" pigeonhole, as I've only got one report of a problem.

• Ho humm.. back to the bleak London winter. I now have two people listing problems with their Ascend P50 routers. 4.65Ci17 dies after the (roughly) 11th packet of 65510 bytes. To the best of my knowledge Ascend are *still* unable to reproduce this.
• The Synoptics (Bay networks) 2813 repeater v5.1.1 appears safe
• The latest upgrade to the Alantec powerhub 7000 (which bears the very complex version number v7-2.6.3.2 pl 9) seems to be no longer vulnerable to the Ping O' Death. Bruce McIntosh tells me that you can contact Fore Systems on 1-800-671-3673 (assuming you are in the US) with regard to downloading the latest code
• Earlier versions of UCX (than v4.0) for VMS are vulnerable to - this may not have been obvious from my pages. v3.3 definately dies., but I have no information on any patches for versions other than 4.0 and 4.1
• The Shiva Access switch (v4.5) ignores the Ping O' Death, unlike the Shiva Access Port, which dies.
• Hubs manufactured by the german company Hirshmann are resistant. I'm not sure exactly what they're called, so I'll just call them "Hirschmann Hubs", because it's kinda catchy.
• Tandem have released patches (or IPM's, in Tandem-speak) for their NSK. Patches are available for the D30 (IPM #T9551ACX) and D40 (IPM #T9551ACY) versions, but no patch is planned for the D20, as it is "at the end of it's life". The message I got on this is reproduced in full on the page.

• Well, I swore I'd never enter one of these places, but I'm sitting in a Net Cafe in Wellington when I should be at the beach. Dedication! On with the news. BTW, as I am paying by the hour for this connection, the credits are not being updated until I get back to the UK.
• 3Com have released patches for their Netbuilder II series. So now the WA v8.3.0.84 and the FF v9.1.0.24 are safe - upgrade time!
• The Lexmark Optra Laser printer is safe
• The Chase IOLAN Terminal server is safe
• The Ascend pipeline 25 is reported safe
• IBMs stylishly-named "Information Warfare Centre" have mailed me a good summary of the problem with the Ping O'Death and the SYN flood too. As well as having the information on patching AIX "Straight from the horses mouth", it's quite a good summary of the two problems in general. It's here, and may be of interest to non-AIX people too.
• The realtime unix-like OS QNX (v4.22) survived

• Hurrah! I'm on holiday now for three weeks in New Zealand. If you e-mail me at Mike.Bremford@bl.uk, it won't get through. Please send mail to mike@opac.bl.uk from now on, otherwise you will think I'm ignoring you. I'll still be keeping the page up to date, just not quite as often (every few days).
• DEC are unable to reproduce the problem with VAX/VMS. If anyone can, send me or Dave Flanders from DEC the crash dump. There is an outside chance this may be something to do with the fact that the box was running Pathworks v5.0. This is reproducible...
• There are temporary patches out for Solaris x86 2.5 and 2.5.1! The ID's are T103170-10 for 2.5 and T103631-05 for 2.5.1. Expect final patches soon. I have no idea what's happening with 2.4, but I expect it's coming.

• Just had a report that Vax/VMS can be crashed... The victim was a MicroVAX 3100-80 running OpenVMS v6.2 and UCX v4.0, and the "perp" was an alpha running NT4.0. Symptoms - the sender gave a "bad IP parameter", the VAX gave a beep, and then dumped memory and rebooted... DEC pretty much convinced me that VAX/VMS was safe, but I'm duty-bound to move this to the "just might be vulnerable" pigeonhole until I hear for sure either way. If anyone can reproduce this I would love to know (and so would DEC I imagine).
• 3Com Netbuilder II router reboots on the Ping o' Death

• FreeBSD 2.2 and 3.0 are safe. In fact, it may be rash but I would hazard a guess that *all* versions of FreeBSD are safe from 2.0 on, and possibly even before.
• Convex have released a patch for their ConvexOS - contact the TAC. They are working on a patch for SPP-UX as we speak
• The 3Com (aka Chipcom) Oncore Advanced Ethernet Management Modules are succeptable, but not terribly so. On receipt of a large (65527 byte) packet, the console spits out the error message "process_input:esballoc failed:pkt dropped", and the Management functions (eg OnDemand NCS) are intermittently impacted for three minutes or so, after which it seems to sort itself out. (The firmware tested here was 4.20-A
• Digitals PESwitch (firmware 1.1.0) dies after 10 or so large packets are passed through it in quick succession.
• OK, I'm amused. In the battle for "who had the patch out fastest", the new Linux time is 2 hours, 35 minutes 10 seconds. (This is based on the time difference between the message notifying the Linux community of the problem, and the message with the patch). It seems no-one could find a Windows '95 box to test it...

• In a sign of Euro-solidarity, we now have two German Mirrors, both here and here, and a Danish one here for your convinience.
• NetBSD 1.1 owners! Someone has crashed their machine when trying to send a ping...

• Time to get a new mailer... I've had a slightly incorrect version of the NT script here for a couple of days. Well, I've been sent a uuencoded copy now, and I'm sure it's correct now. Sorry for the mess.
• Network Systems have let me know that their systems resist the Ping of Death. This includes the Borderguard 1000 and 2000 and the Passport system.
• Tandem do a varient on Irix, which is vulnerable in the same way as standard Irix.
• Well, I was asking for it. Bill Webb from Telebit just thought he'd let me know that he had the emergency patch out for the Netblazers within 2 hours of being notified... . While he was at it, he let me know that there is an emergency patch for the LS-2PT. The official patch (3.1pl12) is now available for the 386 v3.1 systems.
• I've heard that if an NT4 box is pingflooded, especially if it is running the freebie web-server, it can be crashed. Only the one report though, while a lot of people have failed to do even dent it from outside.

• It looks like Windows '95 is vulnerable to the same problemas NT 3.51 and NT 4.0 - it doesn't like sending large packets. There is no hard and fast way to reproduce it, but a few people are killing their '95 machines with the 'ping another.ip.address -l 65527 -s 1 -t' command that Microsoft acknowledge can kill 3.51. I've shuffled '95 up to the "at risk" box, which was quite satisfying actually :-)
• Acorn have tested their RISC OS system (version Internet 4.xx and 5.02) and found it safe
• The following have been tested and found safe: ICL DRS/NX SVR4.2 v 7.7.8, ACC Danube (this agrees with ACC's tests but not with one of our readers...) and an Axis NPS 550 printserver. The ACC Nile hangs for about 15 secs, and then comes back to life.
• Word on the MkLinux front is that the Linux patches can be applied - there might be a few reject files, but you're used to patching them by hand, right? The bad news is that this upgrade is not currently supported by Apple or OSF, so you're on your own if something breaks.
• Greg Thomas has mailed me the patch descriptions for the UCX stack on VMS, which I am now able to reproduce here for your perusing pleasure...

• Updates on the firmware front. Bay Networks have released patches for their routers - the reference is Change Request CR24142. The fix is in 8.12/rev 14 and 10.01/rev 3. 11.00 also contains the fix.
• Telebit have also released an official patch for their Netblazer 40i, so I'll no longer be offering the emergency patch from this site. The latest patch (v3.1 level 12) fixes the problem.
• The word is that you can not apply the AIX patch IX59453 to the Apple Network Server. So if you were thinking of it, don't because you won't be able to boot. Still no word from Apple on this.

• Last one for the day - Win 3.11 with Novell client 32 seems to holds up.

• Maybe I should rename this page to Ping-gate? And as if that wasn't enough, Javier Romeu has done a brilliant job of translating the entire site to Spanish!.
• Welfleet HW running V8 survived, plus several other Wellfleet routers, along with a Morningstar Motorola-based router (v1.6), a Xylogics terminal server, and a PC running BW-NFS
• A nice chap at IBM has just confirmed that MVS TCP/IP 3.1 and 3.2 is quite safe from the Ping of Death. Plus I've been told that Interlink TCP/IP v3.1 for the MVS mainframes is OK too.
• I've also had a report that the Tandem NSK is not all safe. The D30 seems fine, but the D20 and C30 lost their TCP/IP stacks, which is obviously a bit of a bummer - TCP/IP being quite important in a networked environment. Send it a packet of between 32553 and 32739 to kill the stack, between 32740 and 32759 to maim the stack (the process is alive, but not working). Other sizes are returned correctly or ignored. This, together with another report I got on the D42, has pushed the Tandem NSKs to the "at risk" pigeonhole.
• Win 3.1 running PCTCP by FTP software dies on receipt of a 65527 byte packet
• Another success crashing NT4.0. Sure enough, the sending machine died after sending loads of 65527 packets, on a Cabletron 2210 card. Interestingly enough, this also worked on a Windows '95 machine with a 3Com III PCI card - it dies while sending packets.
• Bell's Plan 9 has been tested by (strangely enough) Bell, who have found it invulnerable to the Ping of Death.
• For those of you behind on your upgrades, OS/2 v2.11 and BSDI 2.01 are both fine.
• The Netblazer LS 2PT is vulnerable, and has a spontaneous reboot.
• Apparently Trumpet Winsock for Windows 3.11 dies after a 3k ping! That's crazy...
• BeOS 8.0 is fine
• Well, Irix 5.3 is definately fishy... an SGI shop with 20-25 SGI's running v5.3 has 6 boxes crash every time they get the ping. A patch level thing is suspected. Irix 5.3 also runs on the Onyx Challenge supercomputers, and the two of these tested so far crash every time as well (according to SGI there is no patch available at this time, but they are working on it).

• Convex SPP-UX is vulnerable

• Got some information from Unisys. The problem is there for all the A series machines, but has been fixed in release 32.4 of the TCP/IP software. Upgrade time, people!
• News on the NT front. Marks sent me a shiny new version of the NT 4.0 crash script, and let me know that the problem is with NT sending packets, not receiving them. (This is in line with what we know about NT 3.51).
• Xerox docuprint 4571 printers with the XNIC ethent card (v4.14 and 4.14N3) appear safe.

• SGI Indy running Irix 5.3 is starting to look pretty safe. I've had about 5 reports saying it's OK. Indy owners, do not fret.
• The (indirect) word from Convex is that all versions of their system are vulnerable. They are indeed working on a patch.
• More Mac results - MacTCP again this time. Two crashes on both 7.5.5 and 7.5.3r2
• MkLinux is vulnerable as well, on the PowerPC. I don't know if the patches for Linux can be applied to MkLinux.
• NetBSD v1.2 on x86 appears to be safe.
• Tek have tested out their X-Terminals (now called "Netstations"). The result for all the tested versions was a lock up for about 30 seconds or so, so the status has been updated to a "lapse of reason".
• Apparently DEC now have a patch for OpenVMS. If you are running UCX 4.1, then ECO level 2 will fix the problem. I haven't got any more info as yet.
• A couple of improvements made to the ping-linux.c. Nothing major, just a cleaner compile.
• Well, just this second got my first bug report for the Cisco 4000. So I'm afraid I am duty bound to move it to the "vulnerable" section. It supposedly dies about 70% of the time, with the heavier the load, the higher the kill rate.

• Red face time. I'm afraid the firewall-1 panic was "pre-emptive". The problem definately exists, but is not a problem with the firewall itself. (In fact, the main problem seems to be a bad case of chinese whispers... :-). Please see the Firewall-1 page for information.
• Vircom have pointed out that their TCP/IP stack for the Galacticomm Worldgroup BBS isn't vulnerable. The problem (and patch) is confined to Galacticomms own TCP/IP stack.
• Someone is unable to duplicate the problem for AOS. Anyone with any more info, get in touch...

• They're coming in thick and fast now... Sequent tested their latest beta and DYNIX/ptx v4.2. Not a scratch
• Report of SCO OpenServer 5.0 surviving.
• Info on Apple Network Service. This is definately based on AIX 4.1.4, which is vulnerable. It just has AppleTalk bolted on. This should be fixable with the patch supplied by IBM, or you can wait for Apple to release their own (identical?) patch. (Having said that, I got a report this morning of ANS surviving the POD)
• More confirmations on Solaris x86 2.5.1 dying. V2.5 survived, for some reason...
• NCR MP-RAS SVR4 2.02/2.03 are safe, as is UnixWare 1.0.
• An "unable to reproduce" for the HDS viewstations, HDS code v3.0.4 and HDSware/Server code v3.0.1.
• The pre-powermac macs crash lock up too. Send them 10 or so 65510 packets in a row.
• More MS-Windows 3.11 stacks. Lan Workplace for DOS and Chameleon NFS 4.6 are vulnerable, PC-NFS (Sun's PC TCP/IP stack) survived.
• The guys that write the Sidewinder 3.0 Firewall are relieved to announce it deals just fine with the POD.
• A Tandem K20004 running NSK version D42 lost TCP/IP after the ping.
• Latest word is DEC are working hard and fast on a patch for their UCX tcp/ip
• Cisco want me to tell you all that their MultiNet for OpenVMS on all platforms, plus MultiNet for Windows 3.x and the Cisco TCP/IP suite for 3.x and '95 are safe. Got it? Good. Let's here no more about it then.
• Got a working patch for Linux 1.2.13 now (I've been told the one I had up wasn't applying cleanly)
• NT 4.0 could be vulnerable. This special report coming at you now from a far corner of the Net... Yup, courtesy Mark Rejhon we have a batch file which reportedly *consistently* crashes NT4 within a few minutes of starting up. Its here. Please go easy on the reports, I only have so many hours in the day...
• A suspicion has been raised that the vulnerability could be exploited on any ports, even ports that aren't listened to. Anyone care to confirm or deny?

• Galacticomm have let me know that v3 of their software is OK, and a patch is available for v1 and 2 - details here
• Livingston ORU ISDN-Ethernet router has a reproducable "problem". Not a crash, but it does hang. Dropping the connection and reconnecting kicks it back into life
• Apples A/UX 3.02 is reported to survive, as is Netware 3.12 and Banyan Vines 7.0
• IBM's Secure Network Gateway for AIX firewall seems immune to these things.
• Unisys have tested the U2200 and it passed with flying colours.
• Someone has crashed NT 3.51 by giving a "ping -l 65510 -m 1". This is the second report of a crash with NT, so it looks like the patch Microsoft have produced is really quite necessary
• SCO Openserver 5.0 reportedly crashes instantly. I have a couple of other reports for SCO which say it's OK, but all the same it's been moved to "at risk"

• The press have finally got wind of this, so expect trouble. (Arrgh! The spotty 13 year old wannabe hackers are coming...) Three very nice people are now mirroring in the US, but if anyone else feels they need a local copy (I remember some slow connections from my native NZ) then give a yell.
• It's been pointed out that the problem is not with ping - it's with the underlying handling of packets. This wasn't obvious from the wording on the pages, so I've tried to make it more clear. Bottom line is blocking ping at your firewall is a temporary fix only.
• The NEXTSTEP/i386 vulnerability is network card dependant - i.e. it depends on which driver is being used. Some are vulnerable, some aren't. (The next trick is to find out which is which...) Thanks to Dan Grillo (again) for this.
• Ho Hum, another report of MacTCP being vulnerable...
• Bay Networks Access Stack Nodes (rev 10.0, 10.1 and 11.0) reboot on the POD.
• Windows 3.11 with LINK TCP stack crashes, while Pathway for DOS/Windows seems OK.
• OS/2 has been moved to the "safe as houses" category, following this mildly amusing report from IBM. Sounds like a decent stress test to me. :-)
  D:) FINAL#SOLUTION: Sent info to Dev group and we implement severe testing on Warp Connect, Server and Warp V4. We implemented the Ping from a Win95 box using the prescriped text from the web site and encountered no problems. We then opted to stress test the box by implementing multiple FTP and Telnet Session doing Multi-megabyte mget commands accompanied by 35 different sessions of conncurrent pinging from OS/2 sessions. While all of this was going on, we starting hitting the machine with the Ping of Death and the results were negative. During this, even with the ping of death going, the machine was able open session, ping out and process data with no problems. Therefore, our findings are that as far as we can determine, Warp Connect, Warp Server and Warp V4 are not at risk from this Ping.

• VM Mainframe running IBM TCP/IP for VM v2.2 tested and found OK
• I'm trying to find out if anyone is actually exploiting this problem. I've heard of a couple of ISPs running linux that have had Joe User pinging them to see if they were vulnerable (The linux patch logs where the ping was from). I've done some experiments with a guy in Berkely, California who killed my machine in London, England. Anyone else got any anecdotes?

• Firewall-1 loses its GUI interface for a period of minutes when given a "ping -l 70000". (I thought this was greater than even Win '95 ping can send?). This is pretty serious, as while the firewall is recovering, you can telnet on to it and remove all the filtering. Info on this is under the section.
• Another person with no trouble on an Ascend 130 router (4.6Bp3 this time)
• The B2 version of DG/UX (release 4.11) appears to be safe
• A PC based router running IPR (IP Route) version 0.954 was found safe, along with DOS based Clarkson Telnet
• Ascend have tested their P50 router and swear black and blue it's OK.
• Some more Macintosh test results have come in.

• Some more information added on how to find the patches for AIX.

• News of the hour is Microsoft have released a patch. It seems NT 3.5.1 didn't like sending the packets, but was fine receiving them (trust Microsoft to get it backwards...). NT 3.5.1 has been moved to the "at risk with patches" section, for lack of a better place. Go here for details.
• Information on the Bay Networks AN routers was slightly incorrect - the firmware version tested was 9.2, not 10.0

• Cray C94 Unicos 9.0.2.0 version roo.21 and Cray M92 Unicos 9.0.2.0 version roo.8 - no effect.
• Windows NT 4.0 is reported to suffer damage to its IP stack after the ping - not immediately, but soon afterwards, particularly if the system is busy. Now being moved to the "Just might be vulnerable" bit.
• Digital DECnis router 600 (v3.1.6) is safe
• Windows 3.1 with Digital Pathworks TCP/IP V6.0.034 hangs requiring reboot
• ACC products have tested some systems and found them safe: They are the Amazon (v10.0), the Colorado (8.3.3), Danube (8.1B4), and Tahoe (7.3). Another reader has trouble with the Danube, so who knows.
• Mammoth report from Nick Brown - thanks. The following are all safe:
  • Digital DEClaser 3500 printer Ethernet card, v01.38
  • Digital DEClaser 5100 printer Ethernet card, v03.05
  • Nexland 10T12 12-port SNMP-managed hub, v1.20
  • Nexland 10T24 242-port SNMP-managed hub, v1.20
  • Digital DECconcentrator 900MX FDDI concentrator, v3.1.1
  • Digital RouteAbout EW/MP brouter, v1.1.005
  • Digital DECbrouter 90, v10.2(5)
  • Digital DECrepeater 900TM, v2.0.0
  • Digital DECswitch 900EF, v1.5.2
  • Digital DECbridge 900MX, v1.5.2
  • Digital DECserver 300 V2.2 BL44-3
  • Digital DECserver 700 V1.1 BL44-11
  • ACS 4105 remote Ethernet bridge v2.0 (this is very old firmware)
• BeOS DR8 Network Server is safe