Technical Description

A new vulnerability was identified in multiple vendors' operating systems, which may be exploited by remote attackers to cause a denial of service. This flaw resides in the Transmission Control Protocol (TCP) Timestamps and Protection Against Wrapped Sequence Numbers (PAWS) techniques when handling specially crafted segments containing a large timestamp value.

An attacker who is able to determine the source and destination ports and IP addresses of two hosts engaged in an active connection, could exploit this issue to cause a denial of service (DoS) by injecting a specially crafted segment into the connection.

Note : This vulnerability is NOT related to VUPEN/ADV-2005-0559

Affected Products

Microsoft Windows 2000 Service Pack 3
Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 1
Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium)
Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium)
Microsoft Windows Server 2003
Microsoft Windows Server 2003 for Itanium-based Systems
Cisco SN5400 series storage routers
Cisco CSS11000 series content services switches
Cisco AP350 and AP1200 series Access Points
Cisco MGX series WAN switches
Cisco CallManager
Cisco Conference Connection
Cisco Emergency Responder
Cisco MeetingPlace
Cisco Personal Assistant
Cisco Intelligent Contact Management Product Family
Cisco IP Contact Center Product Family
Cisco Interactive Voice Response Product Family
Cisco Remote Monitoring Suite Option
Cisco Web Collaboration Option
Cisco E-Mail Manager Option
Cisco Agent Desktop
Cisco Support Tools
Cisco Unity
Hitachi AlaxalA AX series
Hitachi GR4000/GR3000/GS4000
FreeBSD
OpenBSD 3.6

Solution

Microsoft fixed this issue with Windows XP Service Pack 2, Windows Server 2003 Service Pack 1, and the MS05-019 security update :
http://www.microsoft.com/technet/security/advisory/899480.mspx
Cisco :
http://www.cisco.com/warp/public/707/cisco-sn-20050518-tcpts.shtml
OpenBSD :
http://openbsd.org/errata36.html#tcp
Hitachi :
http://www.alaxala.com/jp/support/ICMP-20050518.html
http://www.hitachi.co.jp/Prod/comp/network/notice/VU-637934.html

References

http://www.vupen.com/english/advisories/2005/0567
http://www.kb.cert.org/vuls/id/637934

Credits

Vulnerability reported by Noritoshi Demizu

ChangeLog

2005-05-18 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.