Subject: TCP reassembly DoS

OpenBSD's TCP/IP stack did not impose limits on how many out-of-order
TCP segments are queued in the system.

If an attacker was allowed to connect to an open TCP port, he could send
out-of-order TCP segments and trick the system into using all available
memory buffers.  Packet handling would be impaired, and new connections
would fail until the the attacking TCP connection is closed.

The problem is fixed in -current, 3.4-stable and 3.3-stable.

Patches are available at:

  ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/013_tcp.patch
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/018_tcp.patch