SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   OS (Microsoft)  >   Windows TCP/IP Stack Vendors:   Microsoft
(A Variant is Reported) Microsoft Windows TCP, IP, and ICMP Processing Errors Let Remote Users Deny Service and Execute Arbitrary Code
SecurityTracker Alert ID:  1014000
SecurityTracker URL:  http://securitytracker.com/id/1014000
CVE Reference:   CVE-2005-0356   (Links to External Site)
Date:  May 18 2005
Impact:   Denial of service via network, Execution of arbitrary code via network, Root access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2000 SP4 and prior, XP SP2 and prior, 2003 (IPv6 is affected on XP SP2 and 2003 SP1, but not 2000)
Description:   Several vulnerabilities were reported in the Microsoft Windows TCP/IP stack. A remote user can cause denial of service conditions or execute arbitrary code on the target system.

The system does not properly validate user-supplied IP packets. A remote user can send a specially crafted IP packet to the target system to execute arbitrary code on the target system [CVE: CVE-2005-0048]. The code will run with System level privileges.

A remote user can send a specially crafted ICMP pakcet to cause existing TCP connections to be reset [CVE: CVE-2004-0790].

A remote user can send a specially crafted ICMP message to exploit a Path MTU discovery error and cause network performance on the target system to degrade [CVE: CVE-2004-1060]. A remote user can send a specially crafted Path MTU value to trigger this flaw.

A remote user can send a specially crafted spoofed TCP/IP message to cause the target system to stop responding to network connections [CVE: CVE-2005-0688]. The flaw resides in the processing of TCP SYN packets when the source IP address and port is the same as the destination IP address and port, causing a network loop.

The vendor credits Song Liu, Hongzhen Zhou, and Neel Mehta of ISS X-Force with reporting IP validation vulnerability, Fernando Gont of Argentina's Universidad Tecnologica Nacional/Facultad Regional Haedo with reporting the ICMP Connection Reset vulnerability and the ICMP Path MTU vulnerability, and Qualys with reporting the ICMP Path MTU vulnerability.

On May 18, 2005, Microsoft reported a variant of the TCP vulnerability, affecting Windows 2000, Windows 2003, and Windows XP [CVE: CVE-2005-0356]. A remote user can set arbitrary timer values for a TCP connection to cause existing TCP connections to be reset. Systems that have applied Windows XP Service Pack 2, Windows Server 2003 Service Pack 1, or the MS05-019 security update are not affected. The new Microsoft Security Advisory is available at:

http://www.microsoft.com/technet/security/advisory/899480.mspx

Impact:   A remote user can execute arbitrary code on the target system. The code will run with System level privileges.

A remote user can cause TCP connections to be reset.

A remote user can cause network performance to degrade.

A remote user can cause the target system to stop accepting network connections.

Solution:   The vendor has issued two advisories: MS05-019 covering the IPv4 stack, and MS06-064 covering the IPv6 stack.

The vendor has issued the following fixes as part of MS05-019:

Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4:

http://www.microsoft.com/downloads/details.aspx?FamilyId=0C534EE0-DE5B-4002-BB69-C63ED03D5D9D

Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?FamilyId=B6D0437E-5A9E-4AA9-9E84-802A1BC5436C

Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium):

http://www.microsoft.com/downloads/details.aspx?FamilyId=A81DBEC3-58DC-4CE5-86E0-0F38931A8D4B

Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium):

http://www.microsoft.com/downloads/details.aspx?FamilyId=34DC5227-9B9B-4795-A1A0-5FA509B3AD52

Microsoft Windows Server 2003:

http://www.microsoft.com/downloads/details.aspx?FamilyId=616B5880-4439-4D96-8355-D7FCFE40134B

Microsoft Windows Server 2003 for Itanium-based Systems:

http://www.microsoft.com/downloads/details.aspx?FamilyId=34DC5227-9B9B-4795-A1A0-5FA509B3AD52

A restart is required.

On October 10, 2006, Microsoft issued a separate fix (MS06-064) to correct CVE-2004-0790 and CVE-2005-0688 for the IPv6 implementation.

The vendor has issued the following fixes as part of MS06-064 [determined by Microsoft to be Low risk]:

Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?FamilyId=9fd73d12-ff7c-411d-944d-a6f147b20775

Microsoft Windows XP Professional x64 Edition:

http://www.microsoft.com/downloads/details.aspx?FamilyId=fc98f55c-520e-4a68-a3c3-0df51c6122bb

Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?FamilyId=102591a0-2b58-497b-bc20-593571b96e9c

Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems:

http://www.microsoft.com/downloads/details.aspx?FamilyId=12515d47-134d-4d1f-9ae7-f0a7167ec424

Microsoft Windows Server 2003 x64 Edition:

http://www.microsoft.com/downloads/details.aspx?FamilyId=c5faba34-48f5-4875-a0fa-6b8207f9b276

A restart is required.

The Microsoft advisory is available at:

http://www.microsoft.com/technet/security/bulletin/ms06-064.mspx

Vendor URL:  www.microsoft.com/technet/security/advisory/899480.mspx (Links to External Site)
Cause:   Exception handling error, Input validation error, State error

Message History:   This archive entry is a follow-up to the message listed below.
Apr 12 2005 Microsoft Windows TCP, IP, and ICMP Processing Errors Let Remote Users Deny Service and Execute Arbitrary Code



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC