TCP listen()/accept() bug for unbound sockets?

2.4.27,

while investigating the xv_bmpslap XV exploit posted to bugtraq I got this strace which revealed that it seems possible to listen() and accept() on unbound TCP sockets. The bind() failed and the process appeared to be listening on a random port in the ip_local_port_range and connected successfully:

24876 socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 4
24876 bind(4, {sa_family=AF_INET, sin_port=htons(7000), sin_addr=inet_addr("0.0.0.0")}, 16) = -1 EADDRINUSE (Address already in use)

24876 listen(4, 1)                      = 0
24876 accept(4, 0, NULL)                = 5
24876 dup2(5, 0)                        = 0
24876 dup2(5, 1)                        = 1
24876 dup2(5, 2)                        = 2

24876 execve("/bin//sh", ["/bin//sh"], [/* 0 vars */]) = 0

is this defined behavior?

Frank

Yep, we auto-bind the socket for you.