Microsoft Windows TCP, IP, and ICMP Processing Errors Let Remote Users Deny Service and Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1013686
|
|
SecurityTracker URL: http://securitytracker.com/id?1013686
|
|
CVE Reference: CVE-2004-0790
, CVE-2004-1060
, CVE-2005-0048
, CVE-2005-0688
(Links to External Site)
|
Updated: Oct 10 2006
|
Original Entry Date: Apr 12 2005
|
Impact: Denial of service via network, Execution of arbitrary code via network, Root access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Microsoft Security Bulletin
|
Version(s): 2000 SP4 and prior, XP SP2 and prior, 2003 (IPv6 is affected on XP SP2 and 2003 SP1, but not 2000)
|
Description: Several vulnerabilities were reported in the Microsoft Windows TCP/IP stack. A remote user can cause denial of service conditions or execute arbitrary code on the target system.
The system does not properly validate user-supplied IP packets. A remote user can send a specially crafted IP packet to the target
system to execute arbitrary code on the target system [CVE: CAN-2005-0048]. The code will run with System level privileges.
A
remote user can send a specially crafted ICMP pakcet to cause existing TCP connections to be reset [CVE: CAN-2004-0790].
A remote
user can send a specially crafted ICMP message to exploit a Path MTU discovery error and cause network performance on the target
system to degrade [CVE: CAN-2004-1060]. A remote user can send a specially crafted Path MTU value to trigger this flaw.
A remote
user can send a specially crafted spoofed TCP/IP message to cause the target system to stop responding to network connections [CVE:
CAN-2005-0688]. The flaw resides in the processing of TCP SYN packets when the source IP address and port is the same as the destination
IP address and port, causing a network loop.
The vendor credits Song Liu, Hongzhen Zhou, and Neel Mehta of ISS X-Force with reporting
IP validation vulnerability, Fernando Gont of Argentina's Universidad Tecnologica Nacional/Facultad Regional Haedo with reporting
the ICMP Connection Reset vulnerability and the ICMP Path MTU vulnerability, and Qualys with reporting the ICMP Path MTU vulnerability.
The
Windows IPv6 stack is affected by CVE-2004-0790 and CVE-2005-0688.
|
Impact: A remote user can execute arbitrary code on the target system. The code will run with System level privileges.
A remote user
can cause TCP connections to be reset.
A remote user can cause network performance to degrade.
A remote user can cause the
target system to stop accepting network connections.
|
Solution: The vendor has issued two advisories: MS05-019 covering the IPv4 stack, and MS06-064 covering the IPv6 stack.
The vendor has
issued the following fixes as part of MS05-019:
Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack
4:
http://www.microsoft.com/downloads/details.aspx?FamilyId=0C534EE0-DE5B-4002-BB69-C63ED03D5D9D
Microsoft Windows XP Service
Pack 1 and Microsoft Windows XP Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=B6D0437E-5A9E-4AA9-9E84-802A1BC5436C
Microsoft
Windows XP 64-Bit Edition Service Pack 1 (Itanium):
http://www.microsoft.com/downloads/details.aspx?FamilyId=A81DBEC3-58DC-4CE5-86E0-0F38931A8D4B
Microsoft
Windows XP 64-Bit Edition Version 2003 (Itanium):
http://www.microsoft.com/downloads/details.aspx?FamilyId=34DC5227-9B9B-4795-A1A0-5FA509B3AD52
Microsoft
Windows Server 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=616B5880-4439-4D96-8355-D7FCFE40134B
Microsoft
Windows Server 2003 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?FamilyId=34DC5227-9B9B-4795-A1A0-5FA509B3AD52
A
restart is required.
On October 10, 2006, Microsoft issued a separate fix (MS06-064) to correct CVE-2004-0790 and CVE-2005-0688
for the IPv6 implementation.
The vendor has issued the following fixes as part of MS06-064 [determined by Microsoft to be Low
risk]:
Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=9fd73d12-ff7c-411d-944d
-a6f147b20775
Microsoft Windows XP Professional x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=fc98f55c-520e-4a68-a3c3-0df51c6122bb
Micros
oft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=102591a0-2b58-497b-bc20-593571b96e9c
Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems:
http://www.microsoft.com/downloads/de
tails.aspx?FamilyId=12515d47-134d-4d1f-9ae7-f0a7167ec424
Microsoft Windows Server 2003 x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=c5faba3
4-48f5-4875-a0fa-6b8207f9b276
A restart is required.
The Microsoft advisory is available at:
http://www.microsoft.com/technet/security/bulletin/ms06-064.mspx
|
Vendor URL: www.microsoft.com/technet/security/Bulletin/MS05-019.mspx (Links to External Site)
|
Cause: Exception handling error, Input validation error, State error
|
Underlying OS: Windows (2000), Windows (2003), Windows (XP)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Tue, 12 Apr 2005 11:54:08 -0400
Subject: http://www.microsoft.com/technet/security/Bulletin/MS05-019.mspx
|
http://www.microsoft.com/technet/security/Bulletin/MS05-019.mspx
|
|
