If I am not mistaken the mainline bitcoind will accept unsolicited
addr messages, and upon receiving this message - the struct is deserialized, and then verify each address from the unsolicited sender. The
addr struct allows for up to 1,000 arbitrary
addresses:port tuples and there isn't a port restriction... so what exactly is preventing an attacker from flooding the 100k or so Bitciond nodes with the address to some target web servers on 80 and 443?
...To make things more abusable, the client knowingly accepts information drafted in the future, and will retry three times regardless of the error - even on a protocol mismatch. This means that flooding a control-plane service like sshd or a vpn or even an entire IP range of services could cause a lot of problems for a target entity with a large network footprint.
A similar issue to this was exploited on the DC++ network.