(Microsoft Issues Fix) Multiple Vendor TCP Stack Implementations Let Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1017036
|
|
SecurityTracker URL: http://securitytracker.com/id?1017036
|
|
CVE Reference: CVE-2004-0230
(Links to External Site)
|
|
OSVDB Reference: 4030
(Links to External Site)
|
Date: Oct 10 2006
|
Impact: Denial of service via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Microsoft Security Bulletin
|
Description: A vulnerability was reported in several TCP stack implementations. A remote user may be able to cause denial of service conditions using a TCP reset attack. Multiple vendors are affected.
The UK National Infrastructure Security Co-Ordination Centre (NISCC) reported that some implementations of the Transmission Control
Protocol (TCP) are particularly vulnerable to TCP reset attacks. A remote user can cause TCP sessions to terminate prematurely,
causing denial of service conditions.
The specific impact on applications that use TCP depends on the mechanisms built into the
application to address premature TCP session termination.
According to the report, NISCC considers the Border Gateway Protocol
(BGP) to be one of the most affected applications, as it relies on a persistent TCP session between BGP peer entities. Premature
termination of an underlying TCP session may require routing tables to be rebuilt and may cause "route flapping". In the case of
BGP, using the TCP MD5 Signature Option and anti-spoofing measures can mitigate the vulnerability.
Other applications, such as
Domain Name System (DNS) and (Secure Sockets Layer) SSL based applications may also be affected, but to a lesser degree, the report
said.
A remote user can reportedly send a TCP packet with the RST (reset) flag set (or the SYN flag) with the appropriate spoofed
source and destination IP addresses and TCP ports to cause the TCP session to be terminated. Ordinarily, the remote user may have
the probability of 1 in 2^32 of guessing the correct sequence number, the report said. However, in actuality, a remote user may
be able to guess an appropriate sequence number with much greater probability because many implementations will accept any sequence
number within a certain window of the expected sequence number. The Associate Press reports that the proper number can be guessed
within as few as four attempts, requiring only seconds to achieve.
The report credits Paul A. Watson for discovering a practical
method for conducting TCP reset attacks (presented in "Slipping In The Window: TCP Reset Attacks" at the CanSecWest 2004 conference).
The
report indicates that the following vendors are affected [this is not an inclusive list]:
- Cray Inc. is vulnerable on their
UNICOS, UNICOS/mk and UNICOS/mp systems
- Check Point is affected, but has issued a protection mechanism in the latest release
for VPN-1/FireWall-1 (R55 HFA-03) that can protect both the firewall device and hosts located behind the firewall.
- Internet
Initiative Japan, Inc (IIJ) is affected.
- InterNiche NicheStack and NicheLite are affected.
- Juniper Networks products are
affected.
- Cisco products are affected, including IOS and non-IOS based devices.
Other vendors are assessing the impact of
this flaw.
The NISCC Vulnerability Advisory 236929 is available at:
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
|
Impact: A remote user can cause denial of service on the target TCP session. The specific impact depends on the specific vendor implementation.
|
Solution: The vendor has issued the following fixes:
Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2:
http://www.microsoft.com/downloads/details.as
px?FamilyId=9fd73d12-ff7c-411d-944d-a6f147b20775
Microsoft Windows XP Professional x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=fc98f55c-52
0e-4a68-a3c3-0df51c6122bb
Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=1
02591a0-2b58-497b-bc20-593571b96e9c
Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003
with SP1 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?FamilyId=12515d47-134d-4d1f-9ae7-f0a7167ec424
Microsoft
Windows Server 2003 x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=c5faba34-48f5-4875-a0fa-6b8207f9b276
A
restart is required.
The Microsoft advisory is available at:
http://www.microsoft.com/technet/security/bulletin/ms06-064.mspx
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms06-064.mspx (Links to External Site)
|
Cause: State error
|
Underlying OS: Windows (2003), Windows (XP)
|
Underlying OS Comments: 2003 SP1, XP SP2; and prior service packs
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 10 Oct 2006 15:18:04 -0400
Subject: Microsoft Security Bulletin MS06-064: Vulnerabilities in TCP/IP IPv6 Could Allow Denial of Service (922819)
|
http://www.microsoft.com/technet/security/bulletin/ms06-064.mspx
CVE-2004-0790
CVE-2004-0230
CVE-2005-0688
|
|
