Microsoft Windows 2000/Server 2003/XP DHCP Response DHCP ACK authentication spoofing

Summaryinfo

A vulnerability classified as critical has been found in Microsoft Windows 2000/Server 2003/XP. Affected is an unknown function of the component DHCP Response Handler. The manipulation as part of DHCP ACK leads to authentication spoofing. Moreover, an exploit is present. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Microsoft Windows 2000/Server 2003/XP (Operating System) and classified as problematic. This issue affects some unknown processing of the component DHCP Response Handler. The manipulation as part of a DHCP ACK leads to a authentication spoofing vulnerability. Using CWE to declare the problem leads to CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. Impacted is integrity.

The weakness was disclosed 05/28/2014 by Laurent Gaffié with stratsec as Microsoft DHCP INFORM Configuration Overwrite as not defined mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. The public release has been coordinated in cooperation with Microsoft. Access to the local network is required for this attack to succeed. No form of authentication is needed for a successful exploitation. Technical details are unknown but a public exploit is available. The advisory points out:

Windows 2003/XP machines are sending periodic DHCP INFORM requests and are not checking if the DHCP INFORM answer (DHCP ACK) is from the registered DHCP server/relay-server. Any local system may respond to these requests and overwrite a Windows 2003/XP network configuration by sending a properly formatted unicast reply.

A public exploit has been developed by Laurent Gaffié and been published even before and not after the advisory. The exploit is available at blog.spiderlabs.com. It is declared as functional. The vulnerability was handled as a non-public zero-day exploit for at least 40 days. During that time the estimated underground price was around $25k-$100k.

Upgrading eliminates this vulnerability. The mailinglist post contains the following remark:

16/05/2014 - MSRC closes [MSRC]0050886 and doesn't provide any info on if they were successful with Responder in their environment.

ietf.org is providing further details. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 2000
• Server 2003
• XP

License

• commercial

Support

• end of life (old version)

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion