[NT] Vulnerabilities in TCP/IP Allow Remote Code Execution and DoS (MS05-019)

From: SecuriTeam (support_at_securiteam.com)
Date: 04/13/05

Next message: SecuriTeam: "[NEWS] Oracle Forms SQL Injection"

Previous message: SecuriTeam: "[NT] Multiple Vulnerabilities in Windows Kernel Allows Elevation of Privilege and DoS (MS05-018)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 13 Apr 2005 14:01:23 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Vulnerabilities in TCP/IP Allow Remote Code Execution and DoS (MS05-019)
------------------------------------------------------------------------

SUMMARY

Number of networking related vulnerabilities fixed by MS05-019 security
update were reported by Microsoft. Those vulnerabilities are: IP
Validation, ICMP Connection Reset, ICMP Path MTU, TCP Connection Reset and
Spoofed Connection Request.

An attacker who successfully exploited the most severe of these
vulnerabilities could take complete control of an affected system. An
attacker could then install programs; view, change, or delete data; or
create new accounts with full user rights. However, an attacker who
successfully exploited the most severe of these vulnerabilities would most
likely cause the affected system to stop responding.

DETAILS

Vulnerable Systems:
* Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000
Service Pack 4. (
<http://www.microsoft.com/downloads/details.aspx?FamilyId=0C534EE0-DE5B-4002-BB69-C63ED03D5D9D> Update)

* Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service
Pack 2. (
<http://www.microsoft.com/downloads/details.aspx?FamilyId=B6D0437E-5A9E-4AA9-9E84-802A1BC5436C> Update)

* Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium). (
<http://www.microsoft.com/downloads/details.aspx?FamilyId=A81DBEC3-58DC-4CE5-86E0-0F38931A8D4B> Update)

* Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium). (
<http://www.microsoft.com/downloads/details.aspx?FamilyId=34DC5227-9B9B-4795-A1A0-5FA509B3AD52> Update)

* Microsoft Windows Server 2003. (
<http://www.microsoft.com/downloads/details.aspx?FamilyId=616B5880-4439-4D96-8355-D7FCFE40134B> Update)

* Microsoft Windows Server 2003 for Itanium-based Systems. (
<http://www.microsoft.com/downloads/details.aspx?FamilyId=34DC5227-9B9B-4795-A1A0-5FA509B3AD52> Update)

* Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and
Microsoft Windows Millennium Edition (ME).

Immune Systems:
* Microsoft Windows Server 2003 Service Pack 1.
* Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
* Microsoft Windows Server 2003 x64 Edition.
* Microsoft Windows XP Professional x64 Edition.

Executive Summary:
* IP Validation Vulnerability - CAN-2005-0048
* ICMP Connection Reset Vulnerability - CAN-2004-0790
* ICMP Path MTU Vulnerability - CAN-2004-1060
* TCP Connection Reset Vulnerability - CAN-2004-0230
* Spoofed Connection Request Vulnerability - CAN-2005-0688

IP Validation Vulnerability - CAN-2005-0048:
A remote code execution vulnerability exists that could allow an attacker
to send a specially crafted IP message to an affected system. An attacker
who successfully exploited this vulnerability could cause the affected
system to remotely execute code. However, attempts to exploit this
vulnerability would most likely result in a denial of service.

Mitigating Factors for IP Validation Vulnerability - CAN-2005-0048:
This attack requires that routers forward malformed IP network packets.
Most routers will not forward these kinds of malformed IP network packets.
Firewall best practices and standard default firewall configurations can
help protect networks from attacks that originate outside the enterprise
perimeter. Best practices recommend that systems that are connected to the
Internet have a minimal number of ports exposed. Affected systems that
allow any IP connections to the Internet may be vulnerable to this issue.

If enabled, the Internet Connection Firewall does mitigate this
vulnerability on Windows XP Service Pack 1. Windows XP Service Pack 2 and
Windows Server 2003 were not vulnerable to this issue.

Workarounds for IP Validation Vulnerability - CAN-2005-0048:
ISA Server 2000 and ISA Server 2004 can be used to block the affected
types of traffic. Please review the
<http://www.microsoft.com/isaserver/support/prevent/default.asp> ISA
Server Preventative Measures Documentation for more information on how to
use ISA Server to help mitigate this vulnerability.

Use a personal firewall, such as the
<http://go.microsoft.com/fwlink/?LinkId=33335> Internet Connection
Firewall, which is included with Windows XP Service Pack 1.
By default, the Internet Connection Firewall feature in Windows XP Service
Pack 1 helps protect your Internet connection by blocking unsolicited
incoming traffic. We recommend that you block all unsolicited incoming
communication from the Internet.

To enable the Internet Connection Firewall feature by using the Network
Setup Wizard, follow these steps:
1. Click Start, and then click Control Panel.
2. In the default Category View, click Network and Internet Connections,
and then click Setup or change your home or small office network. The
Internet Connection Firewall feature is enabled when you select a
configuration in the Network Setup Wizard that indicates that your system
is connected directly to the Internet.

To configure Internet Connection Firewall manually for a connection,
follow these steps:
1. Click Start, and then click Control Panel.
2. In the default Category View, click Networking and Internet
Connections, and then click Network Connections.
3. Right-click the connection on which you want to enable Internet
Connection Firewall, and then click Properties.
4. Click the Advanced tab.
5. Click to select the Protect my computer or network by limiting or
preventing access to this computer from the Internet check box, and then
click OK.

Note If you want to enable certain programs and services to communicate
through the firewall, click Settings on the Advanced tab, and then select
the programs, the protocols, and the services that are required.

FAQ for IP Validation Vulnerability - CAN-2005-0048:
Q. What is the scope of the vulnerability?
A. This is a remote code execution vulnerability. An attacker who
successfully exploited this vulnerability could remotely take complete
control of an affected system. However, attempts to exploit this
vulnerability would most likely result in a denial of service. An attacker
who exploited this vulnerability could cause the affected system to stop
responding and automatically restart. During that time, affected systems
cannot respond to requests.

Q. What causes the vulnerability?
A. The affected operating systems perform incomplete validation of IP
network packets.

Q. What is IP?
A. The Internet Protocol (IP) is part of the TCP/IP protocol suite. TCP/IP
is a set of networking protocols that are widely used on the Internet.
TCP/IP provides communications across interconnected networks of computers
that have diverse hardware architectures and that run various operating
systems. TCP/IP includes standards for how computers communicate and
conventions for connecting networks and for routing traffic.

Q. What might an attacker use the vulnerability to do?
A. An attacker who successfully exploited this vulnerability could take
complete control of the affected system. However, most likely, an attacker
who exploited this vulnerability could cause the affected system to stop
responding and to automatically restart.

Q. Who could exploit the vulnerability?
A. Any anonymous user who could deliver a specially crafted message to the
affected system could try to exploit this vulnerability.

Q. How could an attacker exploit the vulnerability?
A. An attacker could exploit the vulnerability by creating a specially
crafted message and sending the message to an affected system. The message
could then cause the affected system to execute code or stop responding.

Q. What systems are primarily at risk from the vulnerability?
A. Windows 2000 and Windows XP Service Pack 1 are primarily at risk from
this vulnerability. Windows XP Service Pack 2 and Windows Server 2003
provide additional validation that addresses this vulnerability.

Q. Could the vulnerability be exploited over the Internet?
A. Yes. An attacker could try to exploit this vulnerability over the
Internet. However, this attack requires that routers forward malformed IP
network packets. Most routers will not forward these kinds of malformed IP
network packets.

Q. What does the update do?
A. The update removes the vulnerability by modifying the way that the
affected operating systems validate IP requests.

Q. When this security bulletin was issued, had this vulnerability been
publicly disclosed?
A. No. Microsoft received information about this vulnerability through
responsible disclosure. Microsoft had not received any information to
indicate that this vulnerability had been publicly disclosed when this
security bulletin was originally issued.

Q. When this security bulletin was issued, had Microsoft received any
reports that this vulnerability was being exploited?
A. No. Microsoft had not received any information to indicate that this
vulnerability had been publicly used to attack customers and had not seen
any examples of proof of concept code published when this security
bulletin was originally issued.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0048>
CAN-2005-0048

ICMP Connection Reset Vulnerability - CAN-2004-0790:
A Denial of Service vulnerability exists that could allow an attacker to
send a specially crafted Internet Control Message Protocol (ICMP) message
to an affected system. An attacker who successfully exploited this
vulnerability could cause the affected system to reset existing TCP
connections.

Mitigating Factors for ICMP Connection Reset Vulnerability -
CAN-2004-0790:
Firewall best practices and firewall or router configurations that block
all ICMP traffic can help protect networks from attacks that originate
outside the enterprise perimeter. Best practices recommend that systems
that are connected to the Internet have a minimal number of ports exposed.
For an attacker to try to exploit this vulnerability, they must first
predict or learn the IP address and port information of the source and of
the destination of an existing TCP network connection.
This attack would have to be performed on each TCP connection that was
targeted for reset. Many applications will automatically restore
connections that have been reset.

Workarounds for ICMP Connection Reset Vulnerability - CAN-2004-0790:
Microsoft has tested the following workarounds. While these workarounds
will not correct the underlying vulnerability, they help block known
attack vectors. When a workaround reduces functionality, it is identified
in the following section.

* Block all ICMP network packets at the firewall or at the router:
ICMP network packets are used to initiate a connection with the affected
components. Blocking them at the firewall or at the router will help
protect systems that are behind that firewall or router from attempts to
exploit this vulnerability. We recommend that you block all unsolicited
inbound communication from the Internet. ISA Server 2000 and ISA Server
2004 can be used to block the affected types of traffic.

Impact of Workaround: This workaround can also negatively impact
performance by preventing TCP from optimizing network communication. ICMP
network packets can eliminate fragmentation at routers connecting networks
with different MTUs. Fragmentation reduces TCP throughput and increases
network congestion.

* Block ICMP traffic by using IPSec on the affected systems:
Use Internet Protocol security (IPSec) to help protect network
communications. Detailed information about IPSec and about how to apply
filters is available in Microsoft Knowledge Base Article 313190 and
Microsoft Knowledge Base Article 813878.

FAQ for ICMP Connection Reset Vulnerability - CAN-2004-0790:
Q. What is the scope of the vulnerability?
A. A denial of service vulnerability exists that could allow an attacker
to send a specially crafted ICMP message to an affected system. An
attacker who successfully exploited this vulnerability could cause the
affected system to reset existing TCP connections. Those connections would
have to be re-established for normal communication to continue. Note that
the denial of service vulnerability would not allow an attacker to execute
code or elevate their user rights.

Q. What causes the vulnerability?
A. The affected messages are not being ignored in certain cases that allow
an attacker to send a malformed packet which may cause the reset of an
existing connection.

Q. What is TCP/IP?
A. TCP/IP is a set of networking protocols that are widely used on the
Internet. TCP/IP provides communications across interconnected networks of
computers that have diverse hardware architectures and that run various
operating systems. TCP/IP includes standards for how computers communicate
and conventions for connecting networks and for routing traffic.

Q. What is ICMP?
A. Internet Control Message Protocol (ICMP) is a required TCP/IP standard
that is defined in RFC 792, "Internet Control Message Protocol (ICMP)."
Hosts and routers that use IP communication can report errors and exchange
limited control and status information using ICMP.
ICMP messages are usually sent automatically in one of the following
situations:
* An IP datagram cannot reach its destination.

* An IP router (gateway) cannot forward datagrams at the current rate of
transmission.

* An IP router redirects the sending host to a better route to the
destination.
You can use the ping command to send ICMP echo request messages and to
record the receipt of ICMP echo reply messages. By using these messages,
you can detect network or host communication failures and troubleshoot
common TCP/IP connectivity problems.

Q. What might an attacker use the vulnerability to do?
A. An attacker who exploited this vulnerability could cause the affected
system to reset TCP connections.

Q. Who could exploit the vulnerability?
A. Any anonymous user who could deliver a specially crafted message to the
affected system could try to exploit this vulnerability.

Q. Could the vulnerability be exploited over the Internet?
A. Yes. An attacker could try to exploit this vulnerability over the
Internet. By default, the Microsoft Internet Connection Firewall (ICF)
allows these kinds of malicious network packets and cannot be used to
filter them.

Q. What does the update do?
A. The update removes the vulnerability by modifying the way that the
affected operating systems validate ICMP requests.

Q. When this security bulletin was issued, had this vulnerability been
publicly disclosed?
A. Yes. This vulnerability has been publicly disclosed. It has been
assigned Common Vulnerability and Exposure number CAN-2004-0790. There is
a variant of this issue that has been assigned Common Vulnerability and
Exposure number CAN-2004-0791. The Microsoft security update for
CAN-2004-0790 happens to also address CAN-2004-0791.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0790>
CAN-2004-0790

ICMP Path MTU Vulnerability - CAN-2004-1060
A denial of service vulnerability exists that could allow an attacker to
send a specially crafted Internet Control Message Protocol (ICMP) message
to an affected system that could cause network performance to degrade and
potentially stop the affected system from responding to requests.

Mitigating Factors for ICMP Path MTU Vulnerability - CAN-2004-1060:
Firewall best practices and firewall or router configurations that block
all ICMP traffic can help protect networks from attacks that originate
outside the enterprise perimeter. Best practices recommend that systems
that are connected to the Internet have a minimal number of ports exposed.

For an attacker to try to exploit this vulnerability, they must first
predict or learn the IP address information of the source and of the
destination of an existing TCP network connection.

Workarounds for ICMP Path MTU Vulnerability - CAN-2004-1060:
Microsoft has tested the following workarounds. While these workarounds
will not correct the underlying vulnerability, they help block known
attack vectors. When a workaround reduces functionality, it is identified
in the following section.

Disable Path MTU Discovery
Disabling Path MTU Discovery will prevent an attacker from specifying a
low MTU value that could degrade network performance by following these
steps:

Note Using Registry Editor incorrectly can cause serious problems that may
require you to reinstall your operating system. Microsoft cannot guarantee
that problems resulting from the incorrect use of Registry Editor can be
solved. Use Registry Editor at your own risk. For information about how to
edit the registry, view the "Changing Keys And Values" Help topic in
Registry Editor (Regedit.exe) or view the "Add and Delete Information in
the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.
Note We recommend backing up the registry before you edit it.
1. Click Start, click Run, type "regedt32" (without the quotation marks),
and then click OK.
2. In Registry Editor, locate the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
3. Add the DWORD Value: EnablePMTUDiscovery. Set the value to 0. This
value disables Path MTU Discovery. By default, this key does not exist.
4. You must restart your system for this change to take effect.

Impact of Workaround:These changes will help prevent attacks restricting
the ability of an attacker to reduce the Path MTU value to a low value.
This setting can also negatively impact performance by preventing TCP from
optimizing network communication. This optimization can eliminate
fragmentation at routers connecting networks with different MTUs.
Fragmentation reduces TCP throughput and increases network congestion. For
more information about EnablePMTUDiscovery, see the following
<http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit/en-us/Default.asp?url=/resources/documentation/Windows/2000/server/reskit/en-us/regentry/58752.asp> Web site.

Block all ICMP network packets at the firewall or at the router:
ICMP network packets are used to initiate a connection with the affected
components. Blocking them at the firewall or at the router will help
protect systems that are behind that firewall or router from attempts to
exploit this vulnerability. We recommend that you block all unsolicited
inbound communication from the Internet. ISA Server 2000 and ISA Server
2004 can be used to block the affected types of traffic.

Impact of Workaround:This workaround can also negatively impact
performance by preventing TCP from optimizing network communication. ICMP
network packets can eliminate fragmentation at routers connecting networks
with different MTUs. Fragmentation reduces TCP throughput and increases
network congestion.

Block ICMP traffic by using IPSec on the affected systems.
Use Internet Protocol security (IPSec) to help protect network
communications. Detailed information about IPSec and about how to apply
filters is available in Microsoft Knowledge Base Article 313190 and
Microsoft Knowledge Base Article 813878.

FAQ for ICMP Path MTU Vulnerability - CAN-2004-1060:
Q. What is the scope of the vulnerability?
A. A denial of service vulnerability exists that could allow an attacker
to send a specially crafted Internet Control Message Protocol (ICMP)
message to an affected system that could cause network performance to
degrade and potentially stop the affected system from responding to
requests. Note that the denial of service vulnerability would not allow an
attacker to execute code or elevate their user rights.

Q. What causes the vulnerability?
A. The ICMP Path MTU Discovery process allows an attacker to specify a
Path MTU value that can degrade network performance.

ICMP messages are usually sent automatically in one of the following
situations:
An IP datagram cannot reach its destination.
An IP router (gateway) cannot forward datagrams at the current rate of
transmission.
An IP router redirects the sending host to a better route to the
destination.

You can use the ping command to send ICMP echo request messages and to
record the receipt of ICMP echo reply messages. By using these messages,
you can detect network or host communication failures and troubleshoot
common TCP/IP connectivity problems. For more information about ICMP, see
the following Microsoft Web site.

Q. What is Path MTU Discovery?
A. Path maximum transmission unit (PMTU) discovery is the process of
discovering the maximum size of packet that can be sent across the network
between two hosts without fragmentation (that is, without the packet being
broken into multiple frames during transmission). It is described in RFC
1191. For more information, see
<http://www.ietf.org/rfc/rfc1191.txt?number=1191> RFC 1191.

vQ. What is wrong with the Path MTU Discovery process?
A. Path maximum transmission unit (PMTU) discovery allows an attacker to
specify a value that can degrade network performance for other
connections. On unsecured networks, allowing PMTU discovery carries the
risk that an attacker might force the MTU to a very small value and
overwork the local system's TCP/IP stack. Normally this behavior would be
restricted to the single connection that an attacker could establish.
However, this vulnerability allows an attacker to modify the MTU value on
other connections beyond their own connection to the affected system.

Q. What might an attacker use the vulnerability to do?
A. An attacker who exploited this vulnerability could cause the affected
system to degrade network performance.

Q. Who could exploit the vulnerability?
A. Any anonymous user who could deliver a specially crafted message to the
affected system could try to exploit this vulnerability.

Q. What does the update do?
A. The update removes the vulnerability by restricting the minimum value
of the MTU to 576 bytes. This update also modifies the way that the
affected operating systems validate ICMP requests.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1060>
CAN-2004-1060

TCP Connection Reset Vulnerability - CAN-2004-0230:
A denial of service vulnerability exists that could allow an attacker to
send a specially crafted TCP message to an affected system. An attacker
who successfully exploited this vulnerability could cause the affected
system to reset existing TCP connections.

Mitigating Factors for TCP Connection Reset Vulnerability - CAN-2004-0230:
For an attacker to try to exploit this vulnerability, they must first
predict or learn the IP address and port information of the source and of
the destination of an existing TCP network connection. An attacker would
also have to predict or to learn certain difficult TCP network packet
details. Protocols or programs that maintain long sessions and have
predictable TCP/IP information are at an increased risk for this issue.

Firewall best practices and standard default firewall configurations can
help protect networks from attacks that originate outside the enterprise
perimeter. Best practices recommend that systems that are connected to the
Internet have a minimal number of ports exposed. Affected systems that
allow any TCP connections to the Internet may be vulnerable to this issue.

This attack would have to be performed on each TCP connection that was
targeted for reset. Many applications will automatically restore
connections that have been reset.

Workarounds for TCP Connection Reset Vulnerability - CAN-2004-0230:
No workarounds was identified for this vulnerability.

FAQ for TCP Connection Reset Vulnerability - CAN-2004-0230:
Q. What is the scope of the vulnerability?
A. A denial of service vulnerability exists that could allow an attacker
to send a specially crafted TCP message to an affected system. An attacker
who successfully exploited this vulnerability could cause the affected
system to reset existing TCP connections. Those connections would have to
be reestablished for normal communication to continue. Note that the
denial of service vulnerability would not allow an attacker to execute
code or to elevate their user rights.

Q. What causes the vulnerability?
A. The affected messages are not being ignored in certain cases that allow
an attacker to send a malformed TCP packet which may cause the reset of an
existing connection.

Q. What might an attacker use the vulnerability to do?
A. An attacker who exploited this vulnerability could cause the affected
system to reset TCP connections.

Q. Who could exploit the vulnerability?
A. Any anonymous user who could deliver a specially crafted message to the
affected system and learn or predict the required TCP details could try to
exploit this vulnerability.

For an attacker to try to exploit this vulnerability, they must first
predict or learn the IP address and port information of the source and of
the destination of an existing TCP network connection. An attacker would
also have to predict or learn certain difficult TCP network packet
details.

Q. What systems are primarily at risk from the vulnerability?
A. All affected operating systems are at risk from this vulnerability.
However, servers are at primary risk from this vulnerability because they
maintain connections with clients that could be vulnerable to the
connection reset. Protocols or programs that maintain long sessions and
have predictable TCP/IP information are at an increased risk to this
issue.

Q. Could the vulnerability be exploited over the Internet?
A. Yes. An attacker could try to exploit this vulnerability over the
Internet.

Q. What does the update do?
A. The update removes the vulnerability by modifying the way that the
affected operating systems validate TCP requests.

Q. When this security bulletin was issued, had Microsoft received any
reports that this vulnerability was being exploited?
A. No. Microsoft had seen examples of proof of concept code published
publicly but had not received any information to indicate that this
vulnerability had been publicly used to attack customers when this
security bulletin was originally issued.

Q. Does applying this security update help protect customers from the code
that has been published publicly that attempts to exploit this
vulnerability?
A. Yes. This security update addresses the proof of concept code that has
been publicly published. The vulnerability that has been addressed has
been assigned the Common Vulnerability and Exposure number CAN-2004-0230.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0230>
CAN-2004-0230

Spoofed Connection Request Vulnerability - CAN-2005-0688:
A denial of service vulnerability exists that could allow an attacker to
send a specially crafted TCP/IP message to an affected system. An attacker
who successfully exploited this vulnerability could cause the affected
system to stop responding.

Mitigating Factors for Spoofed Connection Request Vulnerability -
CAN-2005-0688:
The affected system would function as normal after the malicious packets
are finished processing.

This attack requires that routers forward malformed TCP/IP network
packets. Most routers will not forward these kinds of malformed TCP/IP
network packets.
Firewall best practices and standard default firewall configurations can
help protect networks from attacks that originate outside the enterprise
perimeter. Best practices recommend that systems that are connected to the
Internet have a minimal number of ports exposed. Affected systems that
allow any IP connections to the Internet may be vulnerable to this issue.

Windows Server 2003 systems that have enabled the SynAttackProtect
registry value are not vulnerable to this issue. For information on how to
enable this registry value, see the Workarounds section of this
vulnerability. This registry value does not protect other affected
operating systems.

Workarounds for Spoofed Connection Request Vulnerability - CAN-2005-0688:
ISA Server 2000 and ISA Server 2004 can be used to block the affected
types of traffic. Please review the
<http://www.microsoft.com/isaserver/support/prevent/default.asp> ISA
Server Preventative Measures Documentation for more information on how to
use ISA Server to help mitigate this vulnerability.

Enabling the SynAttackProtect registry value on Windows Sever 2003 will
mitigate this vulnerability. Windows Server 2003 systems that have enabled
this registry value are not vulnerable to this issue. Microsoft recommends
that customers enable this registry value. For information on how to
enable this registry value, see the following
<http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/all/deployguide/en-us/58799.asp> Microsoft Web site. This registry value does not protect other affected operating systems.

FAQ for Spoofed Connection Request Vulnerability - CAN-2005-0688:
Q. What is the scope of the vulnerability?
A. This is a denial of service vulnerability. An attacker who exploited
this vulnerability could cause the affected system to stop responding for
a limited time. During that time, affected systems cannot respond to
requests. Note that the denial of service vulnerability would not allow an
attacker to execute code or elevate their user rights, but it could cause
the affected system to stop accepting requests.

Q. What causes the vulnerability?
A. The affected operating systems perform incomplete validation of TCP/IP
network packets. This vulnerability occurs when a Transmission Control
Protocol (TCP) SYN packet is received with a spoofed source Internet
Protocol (IP) address and port number that is identical to that of the
destination IP address and port. The effect of this makes it appear that
the host computer has sent a packet to itself. If this attack is
successful, a loop is created and extra computer CPU time is used.

Q. What might an attacker use the vulnerability to do?
A. An attacker who exploited this vulnerability could cause the affected
system to stop responding.

Q. Who could exploit the vulnerability?
A. Any anonymous user who could deliver a specially crafted message to the
affected system could try to exploit this vulnerability.

Q. What systems are primarily at risk from the vulnerability?
A. Windows XP Service Pack 2 and Windows Server 2003 are primarily at risk
from this vulnerability. Prior operating system versions are not
vulnerable to this issue.

Q. Could the vulnerability be exploited over the Internet?
A. Yes. An attacker could try to exploit this vulnerability over the
Internet. However, this attack requires that routers forward malformed
TCP/IP network packets. Most routers will not forward these kinds of
malformed TCP/IP network packets.

Q. What does the update do?
A. The update removes the vulnerability by modifying the way that the
affected operating systems validate TCP/IP requests.

Q. Does applying this security update help protect customers from the code
that has been published publicly that attempts to exploit this
vulnerability?
A. Yes. This security update addresses the vulnerability that is
demonstrated by the existing proof of concept code that has been
published.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0688>
CAN-2005-0688

ADDITIONAL INFORMATION

The original article can be found at:
<http://www.microsoft.com/technet/security/Bulletin/MS05-019.mspx>
http://www.microsoft.com/technet/security/Bulletin/MS05-019.mspx

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Next message: SecuriTeam: "[NEWS] Oracle Forms SQL Injection"

Previous message: SecuriTeam: "[NT] Multiple Vulnerabilities in Windows Kernel Allows Elevation of Privilege and DoS (MS05-018)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

[NT] Vulnerabilities in TCP/IP IPv6 Allows DoS (MS06-064)
... Vulnerabilities in TCP/IP IPv6 Allows DoS ... this vulnerability could cause the affected system to drop an existing TCP ... connection. ...
(Securiteam)
Re: VCLSID.EXE Problem KB 912812 or 908531?
... The vulnerability is documented in the ... An attacker who successfully exploited this vulnerability ... could take complete control of an affected system. ... or create new accounts with full user rights. ...
(microsoft.public.windowsxp.security_admin)
[NT] Vulnerabilities in Graphics Rendering Engine Allows Code Execution (MS05-053)
... formats that could allow remote code execution or on an affected system. ... A remote code execution vulnerability exists in the rendering of Windows ... An attacker who successfully exploited this vulnerability could take ... E-mail messages that are viewed in plain text format will not contain ...
(Securiteam)
[NT] Security Update for Microsoft Windows (MS04-032)
... vulnerabilities in the Microsoft Windows Management, Virtual DOS Machine, ... Graphics Rendering Engine and in Windows Kernel. ... Window Management Vulnerability - A privilege elevation vulnerability ... an affected system. ...
(Securiteam)
begin Using IE and OE is monumentally and criminally insane.
... "A remote code execution vulnerability exists in Outlook Express ... provides malware or malicious users control of the affected system ... Internet Explorer, Outlook, Outlook Express. ...
(alt.marketing.online.ebay)