SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


Try our Premium Alert Service
 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service





Category:   OS (Microsoft)  >   Windows TCP/IP Stack Vendors:   Microsoft
Microsoft Windows TCP, IP, and ICMP Processing Errors Let Remote Users Deny Service and Execute Arbitrary Code
SecurityTracker Alert ID:  1013686
SecurityTracker URL:  http://securitytracker.com/id/1013686
CVE Reference:   CVE-2004-0790, CVE-2004-1060, CVE-2005-0048, CVE-2005-0688   (Links to External Site)
Updated:  Oct 10 2006
Original Entry Date:  Apr 12 2005
Impact:   Denial of service via network, Execution of arbitrary code via network, Root access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2000 SP4 and prior, XP SP2 and prior, 2003 (IPv6 is affected on XP SP2 and 2003 SP1, but not 2000)
Description:   Several vulnerabilities were reported in the Microsoft Windows TCP/IP stack. A remote user can cause denial of service conditions or execute arbitrary code on the target system.

The system does not properly validate user-supplied IP packets. A remote user can send a specially crafted IP packet to the target system to execute arbitrary code on the target system [CVE: CVE-2005-0048]. The code will run with System level privileges.

A remote user can send a specially crafted ICMP pakcet to cause existing TCP connections to be reset [CVE: CVE-2004-0790].

A remote user can send a specially crafted ICMP message to exploit a Path MTU discovery error and cause network performance on the target system to degrade [CVE: CVE-2004-1060]. A remote user can send a specially crafted Path MTU value to trigger this flaw.

A remote user can send a specially crafted spoofed TCP/IP message to cause the target system to stop responding to network connections [CVE: CVE-2005-0688]. The flaw resides in the processing of TCP SYN packets when the source IP address and port is the same as the destination IP address and port, causing a network loop.

The vendor credits Song Liu, Hongzhen Zhou, and Neel Mehta of ISS X-Force with reporting IP validation vulnerability, Fernando Gont of Argentina's Universidad Tecnologica Nacional/Facultad Regional Haedo with reporting the ICMP Connection Reset vulnerability and the ICMP Path MTU vulnerability, and Qualys with reporting the ICMP Path MTU vulnerability.

The Windows IPv6 stack is affected by CVE-2004-0790 and CVE-2005-0688.

Impact:   A remote user can execute arbitrary code on the target system. The code will run with System level privileges.

A remote user can cause TCP connections to be reset.

A remote user can cause network performance to degrade.

A remote user can cause the target system to stop accepting network connections.

Solution:   The vendor has issued two advisories: MS05-019 covering the IPv4 stack, and MS06-064 covering the IPv6 stack.

The vendor has issued the following fixes as part of MS05-019:

Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4:

http://www.microsoft.com/downloads/details.aspx?FamilyId=0C534EE0-DE5B-4002-BB69-C63ED03D5D9D

Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?FamilyId=B6D0437E-5A9E-4AA9-9E84-802A1BC5436C

Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium):

http://www.microsoft.com/downloads/details.aspx?FamilyId=A81DBEC3-58DC-4CE5-86E0-0F38931A8D4B

Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium):

http://www.microsoft.com/downloads/details.aspx?FamilyId=34DC5227-9B9B-4795-A1A0-5FA509B3AD52

Microsoft Windows Server 2003:

http://www.microsoft.com/downloads/details.aspx?FamilyId=616B5880-4439-4D96-8355-D7FCFE40134B

Microsoft Windows Server 2003 for Itanium-based Systems:

http://www.microsoft.com/downloads/details.aspx?FamilyId=34DC5227-9B9B-4795-A1A0-5FA509B3AD52

A restart is required.

On October 10, 2006, Microsoft issued a separate fix (MS06-064) to correct CVE-2004-0790 and CVE-2005-0688 for the IPv6 implementation.

The vendor has issued the following fixes as part of MS06-064 [determined by Microsoft to be Low risk]:

Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?FamilyId=9fd73d12-ff7c-411d-944d-a6f147b20775

Microsoft Windows XP Professional x64 Edition:

http://www.microsoft.com/downloads/details.aspx?FamilyId=fc98f55c-520e-4a68-a3c3-0df51c6122bb

Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?FamilyId=102591a0-2b58-497b-bc20-593571b96e9c

Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems:

http://www.microsoft.com/downloads/details.aspx?FamilyId=12515d47-134d-4d1f-9ae7-f0a7167ec424

Microsoft Windows Server 2003 x64 Edition:

http://www.microsoft.com/downloads/details.aspx?FamilyId=c5faba34-48f5-4875-a0fa-6b8207f9b276

A restart is required.

The Microsoft advisory is available at:

http://www.microsoft.com/technet/security/bulletin/ms06-064.mspx

Vendor URL:  www.microsoft.com/technet/security/Bulletin/MS05-019.mspx (Links to External Site)
Cause:   Exception handling error, Input validation error, State error

Message History:   This archive entry has one or more follow-up message(s) listed below.
May 18 2005 (A Variant is Reported) Microsoft Windows TCP, IP, and ICMP Processing Errors Let Remote Users Deny Service and Execute Arbitrary Code
A variant of the original vulnerability is reported. The Microsoft fix also addresses this new variant.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2018, SecurityGlobal.net LLC