Critical Security Flaw in Many Ethernet Device Drivers

If one follows the Ethernet Standard correctly, each packet transmitted on an Ethernet network should be a minimum of 46 bytes. Some higher level protocols, however, often require that smaller packets be sent. In this instance, devices are supposed to fill the remaining area with null data (i.e. randomly generated gibberish). However, there seems to be evidence that many Ethernet device drivers do not pad the packets with true null data, and in fact pad it with real data from previous packets!!! Aaaaaaaaaaaaaaaaaaaaah! BAD NEWS!

The investigations were conducted by researchers at @stake Inc., in Cambridge, Mass., and the CERT Coordination Center has posted on its Web site a list of vendors whose products may be affected by this vulnerability. That is available here (http://www.kb.cert.org/vuls/id/412115).

Full story here (http://www.eweek.com/article2/0,3959,809353,00.asp).