[NT] Vulnerabilities in TCP/IP Allow Remote Code Execution and DoS (MS05-019)

From: SecuriTeam (support_at_securiteam.com)
Date: 04/13/05

  • Next message: SecuriTeam: "[NEWS] Oracle Forms SQL Injection"
    To: list@securiteam.com
    Date: 13 Apr 2005 14:01:23 +0200
    
    

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Vulnerabilities in TCP/IP Allow Remote Code Execution and DoS (MS05-019)
    ------------------------------------------------------------------------

    SUMMARY

    Number of networking related vulnerabilities fixed by MS05-019 security
    update were reported by Microsoft. Those vulnerabilities are: IP
    Validation, ICMP Connection Reset, ICMP Path MTU, TCP Connection Reset and
    Spoofed Connection Request.

    An attacker who successfully exploited the most severe of these
    vulnerabilities could take complete control of an affected system. An
    attacker could then install programs; view, change, or delete data; or
    create new accounts with full user rights. However, an attacker who
    successfully exploited the most severe of these vulnerabilities would most
    likely cause the affected system to stop responding.

    DETAILS

    Vulnerable Systems:
     * Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000
    Service Pack 4. (
    <http://www.microsoft.com/downloads/details.aspx?FamilyId=0C534EE0-DE5B-4002-BB69-C63ED03D5D9D> Update)

     * Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service
    Pack 2. (
    <http://www.microsoft.com/downloads/details.aspx?FamilyId=B6D0437E-5A9E-4AA9-9E84-802A1BC5436C> Update)

     * Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium). (
    <http://www.microsoft.com/downloads/details.aspx?FamilyId=A81DBEC3-58DC-4CE5-86E0-0F38931A8D4B> Update)

     * Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium). (
    <http://www.microsoft.com/downloads/details.aspx?FamilyId=34DC5227-9B9B-4795-A1A0-5FA509B3AD52> Update)

     * Microsoft Windows Server 2003. (
    <http://www.microsoft.com/downloads/details.aspx?FamilyId=616B5880-4439-4D96-8355-D7FCFE40134B> Update)

     * Microsoft Windows Server 2003 for Itanium-based Systems. (
    <http://www.microsoft.com/downloads/details.aspx?FamilyId=34DC5227-9B9B-4795-A1A0-5FA509B3AD52> Update)

     * Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and
    Microsoft Windows Millennium Edition (ME).

    Immune Systems:
     * Microsoft Windows Server 2003 Service Pack 1.
     * Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
     * Microsoft Windows Server 2003 x64 Edition.
     * Microsoft Windows XP Professional x64 Edition.

    Executive Summary:
     * IP Validation Vulnerability - CAN-2005-0048
     * ICMP Connection Reset Vulnerability - CAN-2004-0790
     * ICMP Path MTU Vulnerability - CAN-2004-1060
     * TCP Connection Reset Vulnerability - CAN-2004-0230
     * Spoofed Connection Request Vulnerability - CAN-2005-0688

    IP Validation Vulnerability - CAN-2005-0048:
    A remote code execution vulnerability exists that could allow an attacker
    to send a specially crafted IP message to an affected system. An attacker
    who successfully exploited this vulnerability could cause the affected
    system to remotely execute code. However, attempts to exploit this
    vulnerability would most likely result in a denial of service.

    Mitigating Factors for IP Validation Vulnerability - CAN-2005-0048:
    This attack requires that routers forward malformed IP network packets.
    Most routers will not forward these kinds of malformed IP network packets.
    Firewall best practices and standard default firewall configurations can
    help protect networks from attacks that originate outside the enterprise
    perimeter. Best practices recommend that systems that are connected to the
    Internet have a minimal number of ports exposed. Affected systems that
    allow any IP connections to the Internet may be vulnerable to this issue.

    If enabled, the Internet Connection Firewall does mitigate this
    vulnerability on Windows XP Service Pack 1. Windows XP Service Pack 2 and
    Windows Server 2003 were not vulnerable to this issue.

    Workarounds for IP Validation Vulnerability - CAN-2005-0048:
    ISA Server 2000 and ISA Server 2004 can be used to block the affected
    types of traffic. Please review the
    <http://www.microsoft.com/isaserver/support/prevent/default.asp> ISA
    Server Preventative Measures Documentation for more information on how to
    use ISA Server to help mitigate this vulnerability.

    Use a personal firewall, such as the
    <http://go.microsoft.com/fwlink/?LinkId=33335> Internet Connection
    Firewall, which is included with Windows XP Service Pack 1.
    By default, the Internet Connection Firewall feature in Windows XP Service
    Pack 1 helps protect your Internet connection by blocking unsolicited
    incoming traffic. We recommend that you block all unsolicited incoming
    communication from the Internet.

    To enable the Internet Connection Firewall feature by using the Network
    Setup Wizard, follow these steps:
    1. Click Start, and then click Control Panel.
    2. In the default Category View, click Network and Internet Connections,
    and then click Setup or change your home or small office network. The
    Internet Connection Firewall feature is enabled when you select a
    configuration in the Network Setup Wizard that indicates that your system
    is connected directly to the Internet.

    To configure Internet Connection Firewall manually for a connection,
    follow these steps:
    1. Click Start, and then click Control Panel.
    2. In the default Category View, click Networking and Internet
    Connections, and then click Network Connections.
    3. Right-click the connection on which you want to enable Internet
    Connection Firewall, and then click Properties.
    4. Click the Advanced tab.
    5. Click to select the Protect my computer or network by limiting or
    preventing access to this computer from the Internet check box, and then
    click OK.

    Note If you want to enable certain programs and services to communicate
    through the firewall, click Settings on the Advanced tab, and then select
    the programs, the protocols, and the services that are required.

    FAQ for IP Validation Vulnerability - CAN-2005-0048:
    Q. What is the scope of the vulnerability?
    A. This is a remote code execution vulnerability. An attacker who
    successfully exploited this vulnerability could remotely take complete
    control of an affected system. However, attempts to exploit this
    vulnerability would most likely result in a denial of service. An attacker
    who exploited this vulnerability could cause the affected system to stop
    responding and automatically restart. During that time, affected systems
    cannot respond to requests.

    Q. What causes the vulnerability?
    A. The affected operating systems perform incomplete validation of IP
    network packets.

    Q. What is IP?
    A. The Internet Protocol (IP) is part of the TCP/IP protocol suite. TCP/IP
    is a set of networking protocols that are widely used on the Internet.
    TCP/IP provides communications across interconnected networks of computers
    that have diverse hardware architectures and that run various operating
    systems. TCP/IP includes standards for how computers communicate and
    conventions for connecting networks and for routing traffic.

    Q. What might an attacker use the vulnerability to do?
    A. An attacker who successfully exploited this vulnerability could take
    complete control of the affected system. However, most likely, an attacker
    who exploited this vulnerability could cause the affected system to stop
    responding and to automatically restart.

    Q. Who could exploit the vulnerability?
    A. Any anonymous user who could deliver a specially crafted message to the
    affected system could try to exploit this vulnerability.

    Q. How could an attacker exploit the vulnerability?
    A. An attacker could exploit the vulnerability by creating a specially
    crafted message and sending the message to an affected system. The message
    could then cause the affected system to execute code or stop responding.

    Q. What systems are primarily at risk from the vulnerability?
    A. Windows 2000 and Windows XP Service Pack 1 are primarily at risk from
    this vulnerability. Windows XP Service Pack 2 and Windows Server 2003
    provide additional validation that addresses this vulnerability.

    Q. Could the vulnerability be exploited over the Internet?
    A. Yes. An attacker could try to exploit this vulnerability over the
    Internet. However, this attack requires that routers forward malformed IP
    network packets. Most routers will not forward these kinds of malformed IP
    network packets.

    Q. What does the update do?
    A. The update removes the vulnerability by modifying the way that the
    affected operating systems validate IP requests.

    Q. When this security bulletin was issued, had this vulnerability been
    publicly disclosed?
    A. No. Microsoft received information about this vulnerability through
    responsible disclosure. Microsoft had not received any information to
    indicate that this vulnerability had been publicly disclosed when this
    security bulletin was originally issued.

    Q. When this security bulletin was issued, had Microsoft received any
    reports that this vulnerability was being exploited?
    A. No. Microsoft had not received any information to indicate that this
    vulnerability had been publicly used to attack customers and had not seen
    any examples of proof of concept code published when this security
    bulletin was originally issued.

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0048>
    CAN-2005-0048

    ICMP Connection Reset Vulnerability - CAN-2004-0790:
    A Denial of Service vulnerability exists that could allow an attacker to
    send a specially crafted Internet Control Message Protocol (ICMP) message
    to an affected system. An attacker who successfully exploited this
    vulnerability could cause the affected system to reset existing TCP
    connections.

    Mitigating Factors for ICMP Connection Reset Vulnerability -
    CAN-2004-0790:
    Firewall best practices and firewall or router configurations that block
    all ICMP traffic can help protect networks from attacks that originate
    outside the enterprise perimeter. Best practices recommend that systems
    that are connected to the Internet have a minimal number of ports exposed.
    For an attacker to try to exploit this vulnerability, they must first
    predict or learn the IP address and port information of the source and of
    the destination of an existing TCP network connection.
    This attack would have to be performed on each TCP connection that was
    targeted for reset. Many applications will automatically restore
    connections that have been reset.

    Workarounds for ICMP Connection Reset Vulnerability - CAN-2004-0790:
    Microsoft has tested the following workarounds. While these workarounds
    will not correct the underlying vulnerability, they help block known
    attack vectors. When a workaround reduces functionality, it is identified
    in the following section.

     * Block all ICMP network packets at the firewall or at the router:
    ICMP network packets are used to initiate a connection with the affected
    components. Blocking them at the firewall or at the router will help
    protect systems that are behind that firewall or router from attempts to
    exploit this vulnerability. We recommend that you block all unsolicited
    inbound communication from the Internet. ISA Server 2000 and ISA Server
    2004 can be used to block the affected types of traffic.

    Impact of Workaround: This workaround can also negatively impact
    performance by preventing TCP from optimizing network communication. ICMP
    network packets can eliminate fragmentation at routers connecting networks
    with different MTUs. Fragmentation reduces TCP throughput and increases
    network congestion.

     * Block ICMP traffic by using IPSec on the affected systems:
    Use Internet Protocol security (IPSec) to help protect network
    communications. Detailed information about IPSec and about how to apply
    filters is available in Microsoft Knowledge Base Article 313190 and
    Microsoft Knowledge Base Article 813878.

    Impact of Workaround: This workaround can also negatively impact
    performance by preventing TCP from optimizing network communication. ICMP
    network packets can eliminate fragmentation at routers connecting networks
    with different MTUs. Fragmentation reduces TCP throughput and increases
    network congestion.

    FAQ for ICMP Connection Reset Vulnerability - CAN-2004-0790:
    Q. What is the scope of the vulnerability?
    A. A denial of service vulnerability exists that could allow an attacker
    to send a specially crafted ICMP message to an affected system. An
    attacker who successfully exploited this vulnerability could cause the
    affected system to reset existing TCP connections. Those connections would
    have to be re-established for normal communication to continue. Note that
    the denial of service vulnerability would not allow an attacker to execute
    code or elevate their user rights.

    Q. What causes the vulnerability?
    A. The affected messages are not being ignored in certain cases that allow
    an attacker to send a malformed packet which may cause the reset of an
    existing connection.

    Q. What is TCP/IP?
    A. TCP/IP is a set of networking protocols that are widely used on the
    Internet. TCP/IP provides communications across interconnected networks of
    computers that have diverse hardware architectures and that run various
    operating systems. TCP/IP includes standards for how computers communicate
    and conventions for connecting networks and for routing traffic.

    Q. What is ICMP?
    A. Internet Control Message Protocol (ICMP) is a required TCP/IP standard
    that is defined in RFC 792, "Internet Control Message Protocol (ICMP)."
    Hosts and routers that use IP communication can report errors and exchange
    limited control and status information using ICMP.
    ICMP messages are usually sent automatically in one of the following
    situations:
     * An IP datagram cannot reach its destination.

     * An IP router (gateway) cannot forward datagrams at the current rate of
    transmission.

     * An IP router redirects the sending host to a better route to the
    destination.
    You can use the ping command to send ICMP echo request messages and to
    record the receipt of ICMP echo reply messages. By using these messages,
    you can detect network or host communication failures and troubleshoot
    common TCP/IP connectivity problems.

    Q. What might an attacker use the vulnerability to do?
    A. An attacker who exploited this vulnerability could cause the affected
    system to reset TCP connections.

    Q. Who could exploit the vulnerability?
    A. Any anonymous user who could deliver a specially crafted message to the
    affected system could try to exploit this vulnerability.

    Q. How could an attacker exploit the vulnerability?
    A. An attacker could exploit the vulnerability by creating a specially
    crafted message and sending the message to an affected system. The message
    could then cause the affected system to reset network connections.

    Q. What systems are primarily at risk from the vulnerability?
    A. All affected operating systems are at risk from this vulnerability.
    However, servers are at primary risk from this vulnerability because they
    maintain connections with clients that could be vulnerable to the
    connection reset.

    Q. Could the vulnerability be exploited over the Internet?
    A. Yes. An attacker could try to exploit this vulnerability over the
    Internet. By default, the Microsoft Internet Connection Firewall (ICF)
    allows these kinds of malicious network packets and cannot be used to
    filter them.

    Q. What does the update do?
    A. The update removes the vulnerability by modifying the way that the
    affected operating systems validate ICMP requests.

    Q. When this security bulletin was issued, had this vulnerability been
    publicly disclosed?
    A. Yes. This vulnerability has been publicly disclosed. It has been
    assigned Common Vulnerability and Exposure number CAN-2004-0790. There is
    a variant of this issue that has been assigned Common Vulnerability and
    Exposure number CAN-2004-0791. The Microsoft security update for
    CAN-2004-0790 happens to also address CAN-2004-0791.

    Q. When this security bulletin was issued, had Microsoft received any
    reports that this vulnerability was being exploited?
    A. No. Microsoft had not received any information to indicate that this
    vulnerability had been publicly used to attack customers and had not seen
    any examples of proof of concept code published when this security
    bulletin was originally issued.

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0790>
    CAN-2004-0790

    ICMP Path MTU Vulnerability - CAN-2004-1060
    A denial of service vulnerability exists that could allow an attacker to
    send a specially crafted Internet Control Message Protocol (ICMP) message
    to an affected system that could cause network performance to degrade and
    potentially stop the affected system from responding to requests.

    Mitigating Factors for ICMP Path MTU Vulnerability - CAN-2004-1060:
    Firewall best practices and firewall or router configurations that block
    all ICMP traffic can help protect networks from attacks that originate
    outside the enterprise perimeter. Best practices recommend that systems
    that are connected to the Internet have a minimal number of ports exposed.

    For an attacker to try to exploit this vulnerability, they must first
    predict or learn the IP address information of the source and of the
    destination of an existing TCP network connection.

    Workarounds for ICMP Path MTU Vulnerability - CAN-2004-1060:
    Microsoft has tested the following workarounds. While these workarounds
    will not correct the underlying vulnerability, they help block known
    attack vectors. When a workaround reduces functionality, it is identified
    in the following section.

    Disable Path MTU Discovery
    Disabling Path MTU Discovery will prevent an attacker from specifying a
    low MTU value that could degrade network performance by following these
    steps:

    Note Using Registry Editor incorrectly can cause serious problems that may
    require you to reinstall your operating system. Microsoft cannot guarantee
    that problems resulting from the incorrect use of Registry Editor can be
    solved. Use Registry Editor at your own risk. For information about how to
    edit the registry, view the "Changing Keys And Values" Help topic in
    Registry Editor (Regedit.exe) or view the "Add and Delete Information in
    the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.
    Note We recommend backing up the registry before you edit it.
    1. Click Start, click Run, type "regedt32" (without the quotation marks),
    and then click OK.
    2. In Registry Editor, locate the following registry key:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
    3. Add the DWORD Value: EnablePMTUDiscovery. Set the value to 0. This
    value disables Path MTU Discovery. By default, this key does not exist.
    4. You must restart your system for this change to take effect.

    Impact of Workaround:These changes will help prevent attacks restricting
    the ability of an attacker to reduce the Path MTU value to a low value.
    This setting can also negatively impact performance by preventing TCP from
    optimizing network communication. This optimization can eliminate
    fragmentation at routers connecting networks with different MTUs.
    Fragmentation reduces TCP throughput and increases network congestion. For
    more information about EnablePMTUDiscovery, see the following
    <http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit/en-us/Default.asp?url=/resources/documentation/Windows/2000/server/reskit/en-us/regentry/58752.asp> Web site.

    Block all ICMP network packets at the firewall or at the router:
    ICMP network packets are used to initiate a connection with the affected
    components. Blocking them at the firewall or at the router will help
    protect systems that are behind that firewall or router from attempts to
    exploit this vulnerability. We recommend that you block all unsolicited
    inbound communication from the Internet. ISA Server 2000 and ISA Server
    2004 can be used to block the affected types of traffic.

    Impact of Workaround:This workaround can also negatively impact
    performance by preventing TCP from optimizing network communication. ICMP
    network packets can eliminate fragmentation at routers connecting networks
    with different MTUs. Fragmentation reduces TCP throughput and increases
    network congestion.

    Block ICMP traffic by using IPSec on the affected systems.
    Use Internet Protocol security (IPSec) to help protect network
    communications. Detailed information about IPSec and about how to apply
    filters is available in Microsoft Knowledge Base Article 313190 and
    Microsoft Knowledge Base Article 813878.

    Impact of Workaround: This workaround can also negatively impact
    performance by preventing TCP from optimizing network communication. ICMP
    network packets can eliminate fragmentation at routers connecting networks
    with different MTUs. Fragmentation reduces TCP throughput and increases
    network congestion.

    FAQ for ICMP Path MTU Vulnerability - CAN-2004-1060:
    Q. What is the scope of the vulnerability?
    A. A denial of service vulnerability exists that could allow an attacker
    to send a specially crafted Internet Control Message Protocol (ICMP)
    message to an affected system that could cause network performance to
    degrade and potentially stop the affected system from responding to
    requests. Note that the denial of service vulnerability would not allow an
    attacker to execute code or elevate their user rights.

    Q. What causes the vulnerability?
    A. The ICMP Path MTU Discovery process allows an attacker to specify a
    Path MTU value that can degrade network performance.

    Q. What is TCP/IP?
    A. TCP/IP is a set of networking protocols that are widely used on the
    Internet. TCP/IP provides communications across interconnected networks of
    computers that have diverse hardware architectures and that run various
    operating systems. TCP/IP includes standards for how computers communicate
    and conventions for connecting networks and for routing traffic. For more
    information about TCP/IP, see the following
    <http://go.microsoft.com/fwlink/?LinkId=40955> Microsoft Web site.

    Q. What is ICMP?
    A. Internet Control Message Protocol (ICMP) is a required TCP/IP standard
    that is defined in RFC 792, "Internet Control Message Protocol (ICMP)."
    Hosts and routers that use IP communication can report errors and exchange
    limited control and status information using ICMP.

    ICMP messages are usually sent automatically in one of the following
    situations:
    An IP datagram cannot reach its destination.
    An IP router (gateway) cannot forward datagrams at the current rate of
    transmission.
    An IP router redirects the sending host to a better route to the
    destination.

    You can use the ping command to send ICMP echo request messages and to
    record the receipt of ICMP echo reply messages. By using these messages,
    you can detect network or host communication failures and troubleshoot
    common TCP/IP connectivity problems. For more information about ICMP, see
    the following Microsoft Web site.

    Q. What is Path MTU Discovery?
    A. Path maximum transmission unit (PMTU) discovery is the process of
    discovering the maximum size of packet that can be sent across the network
    between two hosts without fragmentation (that is, without the packet being
    broken into multiple frames during transmission). It is described in RFC
    1191. For more information, see
    <http://www.ietf.org/rfc/rfc1191.txt?number=1191> RFC 1191.

    vQ. What is wrong with the Path MTU Discovery process?
    A. Path maximum transmission unit (PMTU) discovery allows an attacker to
    specify a value that can degrade network performance for other
    connections. On unsecured networks, allowing PMTU discovery carries the
    risk that an attacker might force the MTU to a very small value and
    overwork the local system's TCP/IP stack. Normally this behavior would be
    restricted to the single connection that an attacker could establish.
    However, this vulnerability allows an attacker to modify the MTU value on
    other connections beyond their own connection to the affected system.

    Q. What might an attacker use the vulnerability to do?
    A. An attacker who exploited this vulnerability could cause the affected
    system to degrade network performance.

    Q. Who could exploit the vulnerability?
    A. Any anonymous user who could deliver a specially crafted message to the
    affected system could try to exploit this vulnerability.

    Q. How could an attacker exploit the vulnerability?
    A. An attacker could exploit the vulnerability by creating a specially
    crafted message and sending the message to an affected system. The message
    could then cause the affected system to degrade network performance.

    Q. What systems are primarily at risk from the vulnerability?
    A. All affected operating systems are at risk from this vulnerability.
    However, servers are at primary risk from this vulnerability because they
    maintain connections with clients that could be vulnerable to performance
    degradation.

    Q. Could the vulnerability be exploited over the Internet?
    A. Yes. An attacker could try to exploit this vulnerability over the
    Internet. By default, the Microsoft Internet Connection Firewall (ICF)
    allows these kinds of malicious network packets and cannot be used to
    filter them.

    Q. What does the update do?
    A. The update removes the vulnerability by restricting the minimum value
    of the MTU to 576 bytes. This update also modifies the way that the
    affected operating systems validate ICMP requests.

    Q. When this security bulletin was issued, had this vulnerability been
    publicly disclosed?
    A. Yes. This vulnerability has been publicly disclosed. It has been
    assigned Common Vulnerability and Exposure number CAN-2004-1060.

    Q. When this security bulletin was issued, had Microsoft received any
    reports that this vulnerability was being exploited?
    A. No. Microsoft had not received any information to indicate that this
    vulnerability had been publicly used to attack customers and had not seen
    any examples of proof of concept code published when this security
    bulletin was originally issued.

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1060>
    CAN-2004-1060

    TCP Connection Reset Vulnerability - CAN-2004-0230:
    A denial of service vulnerability exists that could allow an attacker to
    send a specially crafted TCP message to an affected system. An attacker
    who successfully exploited this vulnerability could cause the affected
    system to reset existing TCP connections.

    Mitigating Factors for TCP Connection Reset Vulnerability - CAN-2004-0230:
    For an attacker to try to exploit this vulnerability, they must first
    predict or learn the IP address and port information of the source and of
    the destination of an existing TCP network connection. An attacker would
    also have to predict or to learn certain difficult TCP network packet
    details. Protocols or programs that maintain long sessions and have
    predictable TCP/IP information are at an increased risk for this issue.

    Firewall best practices and standard default firewall configurations can
    help protect networks from attacks that originate outside the enterprise
    perimeter. Best practices recommend that systems that are connected to the
    Internet have a minimal number of ports exposed. Affected systems that
    allow any TCP connections to the Internet may be vulnerable to this issue.

    This attack would have to be performed on each TCP connection that was
    targeted for reset. Many applications will automatically restore
    connections that have been reset.

    Workarounds for TCP Connection Reset Vulnerability - CAN-2004-0230:
    No workarounds was identified for this vulnerability.

    FAQ for TCP Connection Reset Vulnerability - CAN-2004-0230:
    Q. What is the scope of the vulnerability?
    A. A denial of service vulnerability exists that could allow an attacker
    to send a specially crafted TCP message to an affected system. An attacker
    who successfully exploited this vulnerability could cause the affected
    system to reset existing TCP connections. Those connections would have to
    be reestablished for normal communication to continue. Note that the
    denial of service vulnerability would not allow an attacker to execute
    code or to elevate their user rights.

    Q. What causes the vulnerability?
    A. The affected messages are not being ignored in certain cases that allow
    an attacker to send a malformed TCP packet which may cause the reset of an
    existing connection.

    Q. What is TCP/IP?
    A. TCP/IP is a set of networking protocols that are widely used on the
    Internet. TCP/IP provides communications across interconnected networks of
    computers that have diverse hardware architectures and that run various
    operating systems. TCP/IP includes standards for how computers communicate
    and conventions for connecting networks and for routing traffic. For more
    information about TCP/IP, see the following
    <http://go.microsoft.com/fwlink/?LinkId=40954> Microsoft Web site.

    Q. What might an attacker use the vulnerability to do?
    A. An attacker who exploited this vulnerability could cause the affected
    system to reset TCP connections.

    Q. Who could exploit the vulnerability?
    A. Any anonymous user who could deliver a specially crafted message to the
    affected system and learn or predict the required TCP details could try to
    exploit this vulnerability.

    Q. How could an attacker exploit the vulnerability?
    A. An attacker could exploit the vulnerability by creating a specially
    crafted message and sending the message to an affected system. The message
    could then cause the affected system to reset TCP connections.

    For an attacker to try to exploit this vulnerability, they must first
    predict or learn the IP address and port information of the source and of
    the destination of an existing TCP network connection. An attacker would
    also have to predict or learn certain difficult TCP network packet
    details.

    Q. What systems are primarily at risk from the vulnerability?
    A. All affected operating systems are at risk from this vulnerability.
    However, servers are at primary risk from this vulnerability because they
    maintain connections with clients that could be vulnerable to the
    connection reset. Protocols or programs that maintain long sessions and
    have predictable TCP/IP information are at an increased risk to this
    issue.

    Q. Could the vulnerability be exploited over the Internet?
    A. Yes. An attacker could try to exploit this vulnerability over the
    Internet.

    Q. What does the update do?
    A. The update removes the vulnerability by modifying the way that the
    affected operating systems validate TCP requests.

    Q. When this security bulletin was issued, had this vulnerability been
    publicly disclosed?
    A. Yes. This vulnerability has been publicly disclosed. It has been
    assigned Common Vulnerability and Exposure number CAN-2004-0230.

    Q. When this security bulletin was issued, had Microsoft received any
    reports that this vulnerability was being exploited?
    A. No. Microsoft had seen examples of proof of concept code published
    publicly but had not received any information to indicate that this
    vulnerability had been publicly used to attack customers when this
    security bulletin was originally issued.

    Q. Does applying this security update help protect customers from the code
    that has been published publicly that attempts to exploit this
    vulnerability?
    A. Yes. This security update addresses the proof of concept code that has
    been publicly published. The vulnerability that has been addressed has
    been assigned the Common Vulnerability and Exposure number CAN-2004-0230.

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0230>
    CAN-2004-0230

    Spoofed Connection Request Vulnerability - CAN-2005-0688:
    A denial of service vulnerability exists that could allow an attacker to
    send a specially crafted TCP/IP message to an affected system. An attacker
    who successfully exploited this vulnerability could cause the affected
    system to stop responding.

    Mitigating Factors for Spoofed Connection Request Vulnerability -
    CAN-2005-0688:
    The affected system would function as normal after the malicious packets
    are finished processing.

    This attack requires that routers forward malformed TCP/IP network
    packets. Most routers will not forward these kinds of malformed TCP/IP
    network packets.
    Firewall best practices and standard default firewall configurations can
    help protect networks from attacks that originate outside the enterprise
    perimeter. Best practices recommend that systems that are connected to the
    Internet have a minimal number of ports exposed. Affected systems that
    allow any IP connections to the Internet may be vulnerable to this issue.

    Windows Server 2003 systems that have enabled the SynAttackProtect
    registry value are not vulnerable to this issue. For information on how to
    enable this registry value, see the Workarounds section of this
    vulnerability. This registry value does not protect other affected
    operating systems.

    Workarounds for Spoofed Connection Request Vulnerability - CAN-2005-0688:
    ISA Server 2000 and ISA Server 2004 can be used to block the affected
    types of traffic. Please review the
    <http://www.microsoft.com/isaserver/support/prevent/default.asp> ISA
    Server Preventative Measures Documentation for more information on how to
    use ISA Server to help mitigate this vulnerability.

    Enabling the SynAttackProtect registry value on Windows Sever 2003 will
    mitigate this vulnerability. Windows Server 2003 systems that have enabled
    this registry value are not vulnerable to this issue. Microsoft recommends
    that customers enable this registry value. For information on how to
    enable this registry value, see the following
    <http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/all/deployguide/en-us/58799.asp> Microsoft Web site. This registry value does not protect other affected operating systems.

    FAQ for Spoofed Connection Request Vulnerability - CAN-2005-0688:
    Q. What is the scope of the vulnerability?
    A. This is a denial of service vulnerability. An attacker who exploited
    this vulnerability could cause the affected system to stop responding for
    a limited time. During that time, affected systems cannot respond to
    requests. Note that the denial of service vulnerability would not allow an
    attacker to execute code or elevate their user rights, but it could cause
    the affected system to stop accepting requests.

    Q. What causes the vulnerability?
    A. The affected operating systems perform incomplete validation of TCP/IP
    network packets. This vulnerability occurs when a Transmission Control
    Protocol (TCP) SYN packet is received with a spoofed source Internet
    Protocol (IP) address and port number that is identical to that of the
    destination IP address and port. The effect of this makes it appear that
    the host computer has sent a packet to itself. If this attack is
    successful, a loop is created and extra computer CPU time is used.

    Q. What is TCP/IP?
    A. TCP/IP is a set of networking protocols that are widely used on the
    Internet. TCP/IP provides communications across interconnected networks of
    computers that have diverse hardware architectures and that run various
    operating systems. TCP/IP includes standards for how computers communicate
    and conventions for connecting networks and for routing traffic. For more
    information about TCP/IP, see the following Microsoft Web site.

    Q. What might an attacker use the vulnerability to do?
    A. An attacker who exploited this vulnerability could cause the affected
    system to stop responding.

    Q. Who could exploit the vulnerability?
    A. Any anonymous user who could deliver a specially crafted message to the
    affected system could try to exploit this vulnerability.

    Q. How could an attacker exploit the vulnerability?
    A. An attacker could exploit the vulnerability by creating a specially
    crafted message and sending the message to an affected system. The message
    could then cause the affected system to stop responding.

    Q. What systems are primarily at risk from the vulnerability?
    A. Windows XP Service Pack 2 and Windows Server 2003 are primarily at risk
    from this vulnerability. Prior operating system versions are not
    vulnerable to this issue.

    Q. Could the vulnerability be exploited over the Internet?
    A. Yes. An attacker could try to exploit this vulnerability over the
    Internet. However, this attack requires that routers forward malformed
    TCP/IP network packets. Most routers will not forward these kinds of
    malformed TCP/IP network packets.

    Q. What does the update do?
    A. The update removes the vulnerability by modifying the way that the
    affected operating systems validate TCP/IP requests.

    Q. When this security bulletin was issued, had this vulnerability been
    publicly disclosed?
    A. Yes. This vulnerability has been publicly disclosed. It has been
    assigned Common Vulnerability and Exposure number CAN-2005-0688. It also
    has been named Land Attack by the larger security community.

    Q. When this security bulletin was issued, had Microsoft received any
    reports that this vulnerability was being exploited?
    A. No. Microsoft had seen examples of proof of concept code published
    publicly but had not received any information to indicate that this
    vulnerability had been publicly used to attack customers when this
    security bulletin was originally issued.

    Q. Does applying this security update help protect customers from the code
    that has been published publicly that attempts to exploit this
    vulnerability?
    A. Yes. This security update addresses the vulnerability that is
    demonstrated by the existing proof of concept code that has been
    published.

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0688>
    CAN-2005-0688

    ADDITIONAL INFORMATION

    The original article can be found at:
    <http://www.microsoft.com/technet/security/Bulletin/MS05-019.mspx>
    http://www.microsoft.com/technet/security/Bulletin/MS05-019.mspx

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.


  • Next message: SecuriTeam: "[NEWS] Oracle Forms SQL Injection"

    Relevant Pages

    • [NT] Vulnerabilities in TCP/IP IPv6 Allows DoS (MS06-064)
      ... Vulnerabilities in TCP/IP IPv6 Allows DoS ... this vulnerability could cause the affected system to drop an existing TCP ... connection. ...
      (Securiteam)
    • Re: VCLSID.EXE Problem KB 912812 or 908531?
      ... The vulnerability is documented in the ... An attacker who successfully exploited this vulnerability ... could take complete control of an affected system. ... or create new accounts with full user rights. ...
      (microsoft.public.windowsxp.security_admin)
    • [NT] Vulnerabilities in Graphics Rendering Engine Allows Code Execution (MS05-053)
      ... formats that could allow remote code execution or on an affected system. ... A remote code execution vulnerability exists in the rendering of Windows ... An attacker who successfully exploited this vulnerability could take ... E-mail messages that are viewed in plain text format will not contain ...
      (Securiteam)
    • [NT] Security Update for Microsoft Windows (MS04-032)
      ... vulnerabilities in the Microsoft Windows Management, Virtual DOS Machine, ... Graphics Rendering Engine and in Windows Kernel. ... Window Management Vulnerability - A privilege elevation vulnerability ... an affected system. ...
      (Securiteam)
    • begin Using IE and OE is monumentally and criminally insane.
      ... "A remote code execution vulnerability exists in Outlook Express ... provides malware or malicious users control of the affected system ... Internet Explorer, Outlook, Outlook Express. ...
      (alt.marketing.online.ebay)