Microsoft Windows Server 2003/XP TCP/IP Stack Land Attack denial of service
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.9 | $0-$5k | 0.00 |
A vulnerability was found in Microsoft Windows Server 2003/XP (Operating System). It has been rated as critical. Affected by this issue is an unknown functionality of the component TCP/IP Stack. The manipulation as part of a Land Attack leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. CVE summarizes:
Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.
The weakness was presented 03/08/2005 by Dejan Levaja as MS05-019 (Website). The advisory is shared for download at isc.sans.org. This vulnerability is handled as CVE-2004-0790 since 08/17/2004. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.
A public exploit has been developed by houseofdabus in C and been published 2 months after the advisory. The exploit is available at hoobie.net. It is declared as proof-of-concept. As 0-day the estimated underground price was around $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 18608 (HP-UX PHNE_33159 : s700_800 11.11 cumulative ARPA Transport patch), which helps to determine the existence of the flaw in a target environment. It is assigned to the family HP-UX Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 43278 (Cisco IOS Crafted ICMP Messages Denial of Service Vulnerability (cisco-sa-20050412-icmp)).
Applying a patch is able to eliminate this problem. The bugfix is ready for download at windowsupdate.microsoft.com.Addressing this vulnerability is possible by firewalling . The best possible mitigation is suggested to be applying a restrictive firewalling. A possible mitigation has been published 4 months after the disclosure of the vulnerability. Attack attempts may be identified with Snort ID 396.
The vulnerability is also documented in the databases at X-Force (17170), Tenable (18608) and Exploit-DB (948). support.microsoft.com is providing further details. See 1364, 1359, 1361 and 1360 for similar entries.
Product
Type
Vendor
Name
Version
License
Support
- end of life (old version)
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 7.5VulDB Meta Temp Score: 6.9
VulDB Base Score: 7.5
VulDB Temp Score: 6.9
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Denial of serviceCWE: CWE-404
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Access: Public
Status: Proof-of-Concept
Author: houseofdabus
Programming Language: 🔍
Download: 🔍
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Nessus ID: 18608
Nessus Name: HP-UX PHNE_33159 : s700_800 11.11 cumulative ARPA Transport patch
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Context: 🔍
Nessus Port: 🔍
OpenVAS ID: 902588
OpenVAS Name: Microsoft Windows Internet Protocol Validation Remote Code Execution Vulnerability
OpenVAS File: 🔍
OpenVAS Family: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Exploit-DB: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: FirewallStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Exploit Delay Time: 🔍
Patch: windowsupdate.microsoft.com
Snort ID: 396
Snort Message: PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set
Snort Class: 🔍
Timeline
08/17/2004 🔍03/07/2005 🔍
03/08/2005 🔍
03/10/2005 🔍
04/12/2005 🔍
04/12/2005 🔍
04/12/2005 🔍
04/13/2005 🔍
04/20/2005 🔍
04/20/2005 🔍
06/24/2005 🔍
07/05/2005 🔍
07/01/2019 🔍
Sources
Vendor: microsoft.comProduct: microsoft.com
Advisory: MS05-019
Researcher: Dejan Levaja
Status: Confirmed
CVE: CVE-2004-0790 (🔍)
OVAL: 🔍
X-Force: 17170 - ICMP Protocol Unreachable TCP denial of service, Medium Risk
SecurityTracker: 1013696
SecurityFocus: 13124 - Multiple Vendor TCP/IP Implementation ICMP Remote Denial Of Service Vulnerabilities
Secunia: 14512 - Microsoft Windows TCP/IP Implementation Vulnerabilities, Moderately Critical
OSVDB: 15457 - Multiple Vendor ICMP Message Handling DoS
Vupen: ADV-2006-3983
scip Labs: https://www.scip.ch/en/?labs.20161013
Misc.: 🔍
See also: 🔍
Entry
Created: 03/10/2005 14:58Updated: 07/01/2019 16:49
Changes: 03/10/2005 14:58 (110), 07/01/2019 16:49 (2)
Complete: 🔍
Cache ID: 3:D1A:103
No comments yet. Languages: en.
Please log in to comment.