ID

VAR-200505-0572

CVE

CVE-2005-0356

TITLE

TCP does not adequately validate segments before updating timestamp value

DESCRIPTION

Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a spoofed packet with a large timer value, which causes the host to discard later packets because they appear to be too old. Certain TCP implementations may allow a remote attacker to arbitrarily modify host timestamp values, leading to a denial-of-service condition. TCP The implementation of the time stamp option is TCP A vulnerability exists that allows the internal timer on a connection to be changed to any value.the system TCP Connection reset and service disruption (DoS) It may be in a state. The Transmission Control Protocol (TCP) defined in RFC 793 allows reliable host-to-host transmission in a message exchange network. RFC 1323 introduces a number of technologies that enhance TCP performance, two of which are TCP timestamps and sequence number rollback protection (PAWS).  There are security holes in the PAWS technology of TCP RFC 1323. If TCP timestamps are enabled, both endpoints of the TCP connection use the internal clock to mark the TCP header with the timestamp value.  This vulnerability can occur if an attacker sends enough TCP PAWS packets to the vulnerable computer. An attacker can set the message timestamp to a large value. When the target machine processes this message, the internal timer will be updated to this value, which may cause all valid messages received afterwards to be discarded because these messages are considered too old or invalid. This technique may cause the target connection to deny service. ---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/ ---------------------------------------------------------------------- TITLE: Cisco Various Products TCP Timestamp Denial of Service SECUNIA ADVISORY ID: SA15393 VERIFY ADVISORY: http://secunia.com/advisories/15393/ CRITICAL: Less critical IMPACT: DoS WHERE: >From remote OPERATING SYSTEM: Cisco SN5400 Series Storage Routers http://secunia.com/product/2188/ Cisco MGX 8900 Series Multiservice Switches http://secunia.com/product/5117/ Cisco MGX 8800 Series Multiservice Switches http://secunia.com/product/5116/ Cisco MGX 8200 Series Edge Concentrators http://secunia.com/product/5115/ Cisco Content Services Switch 11000 Series (WebNS) http://secunia.com/product/1507/ Cisco Aironet 350 Series Access Point http://secunia.com/product/5114/ Cisco Aironet 1200 Series Access Point http://secunia.com/product/1929/ DESCRIPTION: A vulnerability has been reported in some Cisco products, which can be exploited by malicious people to cause a DoS (Denial of Service) on active TCP sessions. Successful exploitation requires knowledge of IP address information of the source and destination of the TCP network connection. The vulnerability affects the following products: * SN5400 series storage routers * CSS11000 series content services switches * AP350 and AP1200 series Access Points running VxWorks * MGX8200, MGX8800, and MGX8900 series WAN switches (only management interfaces) SOLUTION: SN5400 series storage routers: The vulnerability has been addressed by CSCin85370. CSS11000 series content services switches: The vulnerability has been addressed by CSCeh40395. AP350 and AP1200 series Access Points: The vendor recommends upgrading APs running VxWorks to Cisco IOS. MGX series WAN switches: The vulnerability has been documented by CSCeh85125 and CSCeh85130. PROVIDED AND/OR DISCOVERED BY: US-CERT credits Noritoshi Demizu. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sn-20050518-tcpts.shtml OTHER REFERENCES: US-CERT VU#637934: http://www.kb.cert.org/vuls/id/637934 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Cisco has acknowledged that various Cisco products are affected. The published Internet-Draft details three types of attacks, which utilize the following ICMP messages to cause a negative impact on TCP connections either terminating or originating from a vulnerable device. 1) ICMP "hard" error messages 2) ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages (known as PMTUD attacks) 3) ICMP "source quench" messages These attacks can all be exploited to cause TCP connection resets, reduce the throughput in existing TCP connections, or consume large amounts of CPU and memory resources. NOTE: See the original advisory for a list of affected versions. SOLUTION: See patch matrix in vendor advisory for information about fixes

AFFECTED PRODUCTS