Vulnerabilities in TCP/IP Allow Remote Code Execution and DoS (MS05-019)
13 Apr. 2005
Summary
Number of networking related vulnerabilities fixed by MS05-019 security update were reported by Microsoft. Those vulnerabilities are: IP Validation, ICMP Connection Reset, ICMP Path MTU, TCP Connection Reset and Spoofed Connection Request.
An attacker who successfully exploited the most severe of these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. However, an attacker who successfully exploited the most severe of these vulnerabilities would most likely cause the affected system to stop responding.
* Microsoft Windows Server 2003 for Itanium-based Systems. (Update)
* Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME).
Immune Systems:
* Microsoft Windows Server 2003 Service Pack 1.
* Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
* Microsoft Windows Server 2003 x64 Edition.
* Microsoft Windows XP Professional x64 Edition.
IP Validation Vulnerability - CAN-2005-0048:
A remote code execution vulnerability exists that could allow an attacker to send a specially crafted IP message to an affected system. An attacker who successfully exploited this vulnerability could cause the affected system to remotely execute code. However, attempts to exploit this vulnerability would most likely result in a denial of service.
Mitigating Factors for IP Validation Vulnerability - CAN-2005-0048:
This attack requires that routers forward malformed IP network packets. Most routers will not forward these kinds of malformed IP network packets.
Firewall best practices and standard default firewall configurations can help protect networks from attacks that originate outside the enterprise perimeter. Best practices recommend that systems that are connected to the Internet have a minimal number of ports exposed. Affected systems that allow any IP connections to the Internet may be vulnerable to this issue.
If enabled, the Internet Connection Firewall does mitigate this vulnerability on Windows XP Service Pack 1. Windows XP Service Pack 2 and Windows Server 2003 were not vulnerable to this issue.
Workarounds for IP Validation Vulnerability - CAN-2005-0048:
ISA Server 2000 and ISA Server 2004 can be used to block the affected types of traffic. Please review the ISA Server Preventative Measures Documentation for more information on how to use ISA Server to help mitigate this vulnerability.
Use a personal firewall, such as the Internet Connection Firewall, which is included with Windows XP Service Pack 1.
By default, the Internet Connection Firewall feature in Windows XP Service Pack 1 helps protect your Internet connection by blocking unsolicited incoming traffic. We recommend that you block all unsolicited incoming communication from the Internet.
To enable the Internet Connection Firewall feature by using the Network Setup Wizard, follow these steps:
1. Click Start, and then click Control Panel.
2. In the default Category View, click Network and Internet Connections, and then click Setup or change your home or small office network. The Internet Connection Firewall feature is enabled when you select a configuration in the Network Setup Wizard that indicates that your system is connected directly to the Internet.
To configure Internet Connection Firewall manually for a connection, follow these steps:
1. Click Start, and then click Control Panel.
2. In the default Category View, click Networking and Internet Connections, and then click Network Connections.
3. Right-click the connection on which you want to enable Internet Connection Firewall, and then click Properties.
4. Click the Advanced tab.
5. Click to select the Protect my computer or network by limiting or preventing access to this computer from the Internet check box, and then click OK.
Note If you want to enable certain programs and services to communicate through the firewall, click Settings on the Advanced tab, and then select the programs, the protocols, and the services that are required.
FAQ for IP Validation Vulnerability - CAN-2005-0048: Q. What is the scope of the vulnerability?
A. This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could remotely take complete control of an affected system. However, attempts to exploit this vulnerability would most likely result in a denial of service. An attacker who exploited this vulnerability could cause the affected system to stop responding and automatically restart. During that time, affected systems cannot respond to requests.
Q. What causes the vulnerability?
A. The affected operating systems perform incomplete validation of IP network packets.
Q. What is IP?
A. The Internet Protocol (IP) is part of the TCP/IP protocol suite. TCP/IP is a set of networking protocols that are widely used on the Internet. TCP/IP provides communications across interconnected networks of computers that have diverse hardware architectures and that run various operating systems. TCP/IP includes standards for how computers communicate and conventions for connecting networks and for routing traffic.
Q. What might an attacker use the vulnerability to do?
A. An attacker who successfully exploited this vulnerability could take complete control of the affected system. However, most likely, an attacker who exploited this vulnerability could cause the affected system to stop responding and to automatically restart.
Q. Who could exploit the vulnerability?
A. Any anonymous user who could deliver a specially crafted message to the affected system could try to exploit this vulnerability.
Q. How could an attacker exploit the vulnerability?
A. An attacker could exploit the vulnerability by creating a specially crafted message and sending the message to an affected system. The message could then cause the affected system to execute code or stop responding.
Q. What systems are primarily at risk from the vulnerability?
A. Windows 2000 and Windows XP Service Pack 1 are primarily at risk from this vulnerability. Windows XP Service Pack 2 and Windows Server 2003 provide additional validation that addresses this vulnerability.
Q. Could the vulnerability be exploited over the Internet?
A. Yes. An attacker could try to exploit this vulnerability over the Internet. However, this attack requires that routers forward malformed IP network packets. Most routers will not forward these kinds of malformed IP network packets.
Q. What does the update do?
A. The update removes the vulnerability by modifying the way that the affected operating systems validate IP requests.
Q. When this security bulletin was issued, had this vulnerability been publicly disclosed?
A. No. Microsoft received information about this vulnerability through responsible disclosure. Microsoft had not received any information to indicate that this vulnerability had been publicly disclosed when this security bulletin was originally issued.
Q. When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
A. No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.
ICMP Connection Reset Vulnerability - CAN-2004-0790:
A Denial of Service vulnerability exists that could allow an attacker to send a specially crafted Internet Control Message Protocol (ICMP) message to an affected system. An attacker who successfully exploited this vulnerability could cause the affected system to reset existing TCP connections.
Mitigating Factors for ICMP Connection Reset Vulnerability - CAN-2004-0790:
Firewall best practices and firewall or router configurations that block all ICMP traffic can help protect networks from attacks that originate outside the enterprise perimeter. Best practices recommend that systems that are connected to the Internet have a minimal number of ports exposed.
For an attacker to try to exploit this vulnerability, they must first predict or learn the IP address and port information of the source and of the destination of an existing TCP network connection.
This attack would have to be performed on each TCP connection that was targeted for reset. Many applications will automatically restore connections that have been reset.
Workarounds for ICMP Connection Reset Vulnerability - CAN-2004-0790:
Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified in the following section.
* Block all ICMP network packets at the firewall or at the router:
ICMP network packets are used to initiate a connection with the affected components. Blocking them at the firewall or at the router will help protect systems that are behind that firewall or router from attempts to exploit this vulnerability. We recommend that you block all unsolicited inbound communication from the Internet. ISA Server 2000 and ISA Server 2004 can be used to block the affected types of traffic.
Impact of Workaround: This workaround can also negatively impact performance by preventing TCP from optimizing network communication. ICMP network packets can eliminate fragmentation at routers connecting networks with different MTUs. Fragmentation reduces TCP throughput and increases network congestion.
* Block ICMP traffic by using IPSec on the affected systems:
Use Internet Protocol security (IPSec) to help protect network communications. Detailed information about IPSec and about how to apply filters is available in Microsoft Knowledge Base Article 313190 and Microsoft Knowledge Base Article 813878.
Impact of Workaround: This workaround can also negatively impact performance by preventing TCP from optimizing network communication. ICMP network packets can eliminate fragmentation at routers connecting networks with different MTUs. Fragmentation reduces TCP throughput and increases network congestion.
FAQ for ICMP Connection Reset Vulnerability - CAN-2004-0790: Q. What is the scope of the vulnerability?
A. A denial of service vulnerability exists that could allow an attacker to send a specially crafted ICMP message to an affected system. An attacker who successfully exploited this vulnerability could cause the affected system to reset existing TCP connections. Those connections would have to be re-established for normal communication to continue. Note that the denial of service vulnerability would not allow an attacker to execute code or elevate their user rights.
Q. What causes the vulnerability?
A. The affected messages are not being ignored in certain cases that allow an attacker to send a malformed packet which may cause the reset of an existing connection.
Q. What is TCP/IP?
A. TCP/IP is a set of networking protocols that are widely used on the Internet. TCP/IP provides communications across interconnected networks of computers that have diverse hardware architectures and that run various operating systems. TCP/IP includes standards for how computers communicate and conventions for connecting networks and for routing traffic.
Q. What is ICMP?
A. Internet Control Message Protocol (ICMP) is a required TCP/IP standard that is defined in RFC 792, "Internet Control Message Protocol (ICMP)." Hosts and routers that use IP communication can report errors and exchange limited control and status information using ICMP.
ICMP messages are usually sent automatically in one of the following situations:
* An IP datagram cannot reach its destination.
* An IP router (gateway) cannot forward datagrams at the current rate of transmission.
* An IP router redirects the sending host to a better route to the destination.
You can use the ping command to send ICMP echo request messages and to record the receipt of ICMP echo reply messages. By using these messages, you can detect network or host communication failures and troubleshoot common TCP/IP connectivity problems.
Q. What might an attacker use the vulnerability to do?
A. An attacker who exploited this vulnerability could cause the affected system to reset TCP connections.
Q. Who could exploit the vulnerability?
A. Any anonymous user who could deliver a specially crafted message to the affected system could try to exploit this vulnerability.
Q. How could an attacker exploit the vulnerability?
A. An attacker could exploit the vulnerability by creating a specially crafted message and sending the message to an affected system. The message could then cause the affected system to reset network connections.
Q. What systems are primarily at risk from the vulnerability?
A. All affected operating systems are at risk from this vulnerability. However, servers are at primary risk from this vulnerability because they maintain connections with clients that could be vulnerable to the connection reset.
Q. Could the vulnerability be exploited over the Internet?
A. Yes. An attacker could try to exploit this vulnerability over the Internet. By default, the Microsoft Internet Connection Firewall (ICF) allows these kinds of malicious network packets and cannot be used to filter them.
Q. What does the update do?
A. The update removes the vulnerability by modifying the way that the affected operating systems validate ICMP requests.
Q. When this security bulletin was issued, had this vulnerability been publicly disclosed?
A. Yes. This vulnerability has been publicly disclosed. It has been assigned Common Vulnerability and Exposure number CAN-2004-0790. There is a variant of this issue that has been assigned Common Vulnerability and Exposure number CAN-2004-0791. The Microsoft security update for CAN-2004-0790 happens to also address CAN-2004-0791.
Q. When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
A. No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.
ICMP Path MTU Vulnerability - CAN-2004-1060
A denial of service vulnerability exists that could allow an attacker to send a specially crafted Internet Control Message Protocol (ICMP) message to an affected system that could cause network performance to degrade and potentially stop the affected system from responding to requests.
Mitigating Factors for ICMP Path MTU Vulnerability - CAN-2004-1060:
Firewall best practices and firewall or router configurations that block all ICMP traffic can help protect networks from attacks that originate outside the enterprise perimeter. Best practices recommend that systems that are connected to the Internet have a minimal number of ports exposed.
For an attacker to try to exploit this vulnerability, they must first predict or learn the IP address information of the source and of the destination of an existing TCP network connection.
Workarounds for ICMP Path MTU Vulnerability - CAN-2004-1060:
Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified in the following section.
Disable Path MTU Discovery
Disabling Path MTU Discovery will prevent an attacker from specifying a low MTU value that could degrade network performance by following these steps:
Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.
Note We recommend backing up the registry before you edit it.
1. Click Start, click Run, type "regedt32" (without the quotation marks), and then click OK.
2. In Registry Editor, locate the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
3. Add the DWORD Value: EnablePMTUDiscovery. Set the value to 0. This value disables Path MTU Discovery. By default, this key does not exist.
4. You must restart your system for this change to take effect.
Impact of Workaround:These changes will help prevent attacks restricting the ability of an attacker to reduce the Path MTU value to a low value. This setting can also negatively impact performance by preventing TCP from optimizing network communication. This optimization can eliminate fragmentation at routers connecting networks with different MTUs. Fragmentation reduces TCP throughput and increases network congestion. For more information about EnablePMTUDiscovery, see the following Web site.
Block all ICMP network packets at the firewall or at the router:
ICMP network packets are used to initiate a connection with the affected components. Blocking them at the firewall or at the router will help protect systems that are behind that firewall or router from attempts to exploit this vulnerability. We recommend that you block all unsolicited inbound communication from the Internet. ISA Server 2000 and ISA Server 2004 can be used to block the affected types of traffic.
Impact of Workaround:This workaround can also negatively impact performance by preventing TCP from optimizing network communication. ICMP network packets can eliminate fragmentation at routers connecting networks with different MTUs. Fragmentation reduces TCP throughput and increases network congestion.
Block ICMP traffic by using IPSec on the affected systems.
Use Internet Protocol security (IPSec) to help protect network communications. Detailed information about IPSec and about how to apply filters is available in Microsoft Knowledge Base Article 313190 and Microsoft Knowledge Base Article 813878.
Impact of Workaround: This workaround can also negatively impact performance by preventing TCP from optimizing network communication. ICMP network packets can eliminate fragmentation at routers connecting networks with different MTUs. Fragmentation reduces TCP throughput and increases network congestion.
FAQ for ICMP Path MTU Vulnerability - CAN-2004-1060: Q. What is the scope of the vulnerability?
A. A denial of service vulnerability exists that could allow an attacker to send a specially crafted Internet Control Message Protocol (ICMP) message to an affected system that could cause network performance to degrade and potentially stop the affected system from responding to requests. Note that the denial of service vulnerability would not allow an attacker to execute code or elevate their user rights.
Q. What causes the vulnerability?
A. The ICMP Path MTU Discovery process allows an attacker to specify a Path MTU value that can degrade network performance.
Q. What is TCP/IP?
A. TCP/IP is a set of networking protocols that are widely used on the Internet. TCP/IP provides communications across interconnected networks of computers that have diverse hardware architectures and that run various operating systems. TCP/IP includes standards for how computers communicate and conventions for connecting networks and for routing traffic. For more information about TCP/IP, see the following Microsoft Web site.
Q. What is ICMP?
A. Internet Control Message Protocol (ICMP) is a required TCP/IP standard that is defined in RFC 792, "Internet Control Message Protocol (ICMP)." Hosts and routers that use IP communication can report errors and exchange limited control and status information using ICMP.
ICMP messages are usually sent automatically in one of the following situations:
An IP datagram cannot reach its destination.
An IP router (gateway) cannot forward datagrams at the current rate of transmission.
An IP router redirects the sending host to a better route to the destination.
You can use the ping command to send ICMP echo request messages and to record the receipt of ICMP echo reply messages. By using these messages, you can detect network or host communication failures and troubleshoot common TCP/IP connectivity problems. For more information about ICMP, see the following Microsoft Web site.
Q. What is Path MTU Discovery?
A. Path maximum transmission unit (PMTU) discovery is the process of discovering the maximum size of packet that can be sent across the network between two hosts without fragmentation (that is, without the packet being broken into multiple frames during transmission). It is described in RFC 1191. For more information, see RFC 1191.
vQ. What is wrong with the Path MTU Discovery process?
A. Path maximum transmission unit (PMTU) discovery allows an attacker to specify a value that can degrade network performance for other connections. On unsecured networks, allowing PMTU discovery carries the risk that an attacker might force the MTU to a very small value and overwork the local system's TCP/IP stack. Normally this behavior would be restricted to the single connection that an attacker could establish. However, this vulnerability allows an attacker to modify the MTU value on other connections beyond their own connection to the affected system.
Q. What might an attacker use the vulnerability to do?
A. An attacker who exploited this vulnerability could cause the affected system to degrade network performance.
Q. Who could exploit the vulnerability?
A. Any anonymous user who could deliver a specially crafted message to the affected system could try to exploit this vulnerability.
Q. How could an attacker exploit the vulnerability?
A. An attacker could exploit the vulnerability by creating a specially crafted message and sending the message to an affected system. The message could then cause the affected system to degrade network performance.
Q. What systems are primarily at risk from the vulnerability?
A. All affected operating systems are at risk from this vulnerability. However, servers are at primary risk from this vulnerability because they maintain connections with clients that could be vulnerable to performance degradation.
Q. Could the vulnerability be exploited over the Internet?
A. Yes. An attacker could try to exploit this vulnerability over the Internet. By default, the Microsoft Internet Connection Firewall (ICF) allows these kinds of malicious network packets and cannot be used to filter them.
Q. What does the update do?
A. The update removes the vulnerability by restricting the minimum value of the MTU to 576 bytes. This update also modifies the way that the affected operating systems validate ICMP requests.
Q. When this security bulletin was issued, had this vulnerability been publicly disclosed?
A. Yes. This vulnerability has been publicly disclosed. It has been assigned Common Vulnerability and Exposure number CAN-2004-1060.
Q. When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
A. No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.
TCP Connection Reset Vulnerability - CAN-2004-0230:
A denial of service vulnerability exists that could allow an attacker to send a specially crafted TCP message to an affected system. An attacker who successfully exploited this vulnerability could cause the affected system to reset existing TCP connections.
Mitigating Factors for TCP Connection Reset Vulnerability - CAN-2004-0230:
For an attacker to try to exploit this vulnerability, they must first predict or learn the IP address and port information of the source and of the destination of an existing TCP network connection. An attacker would also have to predict or to learn certain difficult TCP network packet details. Protocols or programs that maintain long sessions and have predictable TCP/IP information are at an increased risk for this issue.
Firewall best practices and standard default firewall configurations can help protect networks from attacks that originate outside the enterprise perimeter. Best practices recommend that systems that are connected to the Internet have a minimal number of ports exposed. Affected systems that allow any TCP connections to the Internet may be vulnerable to this issue.
This attack would have to be performed on each TCP connection that was targeted for reset. Many applications will automatically restore connections that have been reset.
Workarounds for TCP Connection Reset Vulnerability - CAN-2004-0230:
No workarounds was identified for this vulnerability.
FAQ for TCP Connection Reset Vulnerability - CAN-2004-0230: Q. What is the scope of the vulnerability?
A. A denial of service vulnerability exists that could allow an attacker to send a specially crafted TCP message to an affected system. An attacker who successfully exploited this vulnerability could cause the affected system to reset existing TCP connections. Those connections would have to be reestablished for normal communication to continue. Note that the denial of service vulnerability would not allow an attacker to execute code or to elevate their user rights.
Q. What causes the vulnerability?
A. The affected messages are not being ignored in certain cases that allow an attacker to send a malformed TCP packet which may cause the reset of an existing connection.
Q. What is TCP/IP?
A. TCP/IP is a set of networking protocols that are widely used on the Internet. TCP/IP provides communications across interconnected networks of computers that have diverse hardware architectures and that run various operating systems. TCP/IP includes standards for how computers communicate and conventions for connecting networks and for routing traffic. For more information about TCP/IP, see the following Microsoft Web site.
Q. What might an attacker use the vulnerability to do?
A. An attacker who exploited this vulnerability could cause the affected system to reset TCP connections.
Q. Who could exploit the vulnerability?
A. Any anonymous user who could deliver a specially crafted message to the affected system and learn or predict the required TCP details could try to exploit this vulnerability.
Q. How could an attacker exploit the vulnerability?
A. An attacker could exploit the vulnerability by creating a specially crafted message and sending the message to an affected system. The message could then cause the affected system to reset TCP connections.
For an attacker to try to exploit this vulnerability, they must first predict or learn the IP address and port information of the source and of the destination of an existing TCP network connection. An attacker would also have to predict or learn certain difficult TCP network packet details.
Q. What systems are primarily at risk from the vulnerability?
A. All affected operating systems are at risk from this vulnerability. However, servers are at primary risk from this vulnerability because they maintain connections with clients that could be vulnerable to the connection reset. Protocols or programs that maintain long sessions and have predictable TCP/IP information are at an increased risk to this issue.
Q. Could the vulnerability be exploited over the Internet?
A. Yes. An attacker could try to exploit this vulnerability over the Internet.
Q. What does the update do?
A. The update removes the vulnerability by modifying the way that the affected operating systems validate TCP requests.
Q. When this security bulletin was issued, had this vulnerability been publicly disclosed?
A. Yes. This vulnerability has been publicly disclosed. It has been assigned Common Vulnerability and Exposure number CAN-2004-0230.
Q. When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
A. No. Microsoft had seen examples of proof of concept code published publicly but had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.
Q. Does applying this security update help protect customers from the code that has been published publicly that attempts to exploit this vulnerability?
A. Yes. This security update addresses the proof of concept code that has been publicly published. The vulnerability that has been addressed has been assigned the Common Vulnerability and Exposure number CAN-2004-0230.
Spoofed Connection Request Vulnerability - CAN-2005-0688:
A denial of service vulnerability exists that could allow an attacker to send a specially crafted TCP/IP message to an affected system. An attacker who successfully exploited this vulnerability could cause the affected system to stop responding.
Mitigating Factors for Spoofed Connection Request Vulnerability - CAN-2005-0688:
The affected system would function as normal after the malicious packets are finished processing.
This attack requires that routers forward malformed TCP/IP network packets. Most routers will not forward these kinds of malformed TCP/IP network packets.
Firewall best practices and standard default firewall configurations can help protect networks from attacks that originate outside the enterprise perimeter. Best practices recommend that systems that are connected to the Internet have a minimal number of ports exposed. Affected systems that allow any IP connections to the Internet may be vulnerable to this issue.
Windows Server 2003 systems that have enabled the SynAttackProtect registry value are not vulnerable to this issue. For information on how to enable this registry value, see the Workarounds section of this vulnerability. This registry value does not protect other affected operating systems.
Workarounds for Spoofed Connection Request Vulnerability - CAN-2005-0688:
ISA Server 2000 and ISA Server 2004 can be used to block the affected types of traffic. Please review the ISA Server Preventative Measures Documentation for more information on how to use ISA Server to help mitigate this vulnerability.
Enabling the SynAttackProtect registry value on Windows Sever 2003 will mitigate this vulnerability. Windows Server 2003 systems that have enabled this registry value are not vulnerable to this issue. Microsoft recommends that customers enable this registry value. For information on how to enable this registry value, see the following Microsoft Web site. This registry value does not protect other affected operating systems.
FAQ for Spoofed Connection Request Vulnerability - CAN-2005-0688: Q. What is the scope of the vulnerability?
A. This is a denial of service vulnerability. An attacker who exploited this vulnerability could cause the affected system to stop responding for a limited time. During that time, affected systems cannot respond to requests. Note that the denial of service vulnerability would not allow an attacker to execute code or elevate their user rights, but it could cause the affected system to stop accepting requests.
Q. What causes the vulnerability?
A. The affected operating systems perform incomplete validation of TCP/IP network packets. This vulnerability occurs when a Transmission Control Protocol (TCP) SYN packet is received with a spoofed source Internet Protocol (IP) address and port number that is identical to that of the destination IP address and port. The effect of this makes it appear that the host computer has sent a packet to itself. If this attack is successful, a loop is created and extra computer CPU time is used.
Q. What is TCP/IP?
A. TCP/IP is a set of networking protocols that are widely used on the Internet. TCP/IP provides communications across interconnected networks of computers that have diverse hardware architectures and that run various operating systems. TCP/IP includes standards for how computers communicate and conventions for connecting networks and for routing traffic. For more information about TCP/IP, see the following Microsoft Web site.
Q. What might an attacker use the vulnerability to do?
A. An attacker who exploited this vulnerability could cause the affected system to stop responding.
Q. Who could exploit the vulnerability?
A. Any anonymous user who could deliver a specially crafted message to the affected system could try to exploit this vulnerability.
Q. How could an attacker exploit the vulnerability?
A. An attacker could exploit the vulnerability by creating a specially crafted message and sending the message to an affected system. The message could then cause the affected system to stop responding.
Q. What systems are primarily at risk from the vulnerability?
A. Windows XP Service Pack 2 and Windows Server 2003 are primarily at risk from this vulnerability. Prior operating system versions are not vulnerable to this issue.
Q. Could the vulnerability be exploited over the Internet?
A. Yes. An attacker could try to exploit this vulnerability over the Internet. However, this attack requires that routers forward malformed TCP/IP network packets. Most routers will not forward these kinds of malformed TCP/IP network packets.
Q. What does the update do?
A. The update removes the vulnerability by modifying the way that the affected operating systems validate TCP/IP requests.
Q. When this security bulletin was issued, had this vulnerability been publicly disclosed?
A. Yes. This vulnerability has been publicly disclosed. It has been assigned Common Vulnerability and Exposure number CAN-2005-0688. It also has been named Land Attack by the larger security community.
Q. When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
A. No. Microsoft had seen examples of proof of concept code published publicly but had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.
Q. Does applying this security update help protect customers from the code that has been published publicly that attempts to exploit this vulnerability?
A. Yes. This security update addresses the vulnerability that is demonstrated by the existing proof of concept code that has been published.
