BID:13658

Microsoft IPv6 TCP/IP Loopback LAND Denial of Service Vulnerability

Info

Microsoft IPv6 TCP/IP Loopback LAND Denial of Service Vulnerability

Bugtraq ID:	13658
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2005-0688 CVE-2005-1649
Remote:	Yes
Local:	No
Published:	May 17 2005 12:00AM
Updated:	Jul 06 2016 02:40PM
Credit:	Konrad Malewski <[email protected]> is credited with the discovery of this issue.
Vulnerable:	Sun SunOS 4.1.4 Sun SunOS 4.1.3 _U1 SCO Unixware 2.1 SCO Open Server 5.0 SCO Open Desktop 3.0 SCO CMW+ 3.0 Novell Netware 4.1 NetBSD NetBSD 1.2.1 NetBSD NetBSD 1.2 NetBSD NetBSD 1.1 NetBSD NetBSD 1.0 Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP Gold 0 Microsoft Windows XP Embedded SP1 Microsoft Windows XP Embedded Microsoft Windows XP 64-bit Edition Version 2003 SP1 Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows XP 0 Microsoft Windows Server 2003 Web Edition SP1 Beta 1 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Standard Edition SP1 Beta 1 Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Beta 1 Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition SP1 Beta 1 Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Beta 1 Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition SP1 Beta 1 Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows NT Workstation 4.0 SP3 Microsoft Windows NT Workstation 4.0 SP2 Microsoft Windows NT Workstation 4.0 SP1 Microsoft Windows NT Workstation 4.0 Microsoft Windows NT Terminal Server 4.0 SP3 Microsoft Windows NT Terminal Server 4.0 SP2 Microsoft Windows NT Terminal Server 4.0 SP1 Microsoft Windows NT Terminal Server 4.0 Microsoft Windows NT Server 4.0 SP3 Microsoft Windows NT Server 4.0 SP2 Microsoft Windows NT Server 4.0 SP1 Microsoft Windows NT Server 4.0 Microsoft Windows NT Enterprise Server 4.0 SP3 Microsoft Windows NT Enterprise Server 4.0 SP2 Microsoft Windows NT Enterprise Server 4.0 SP1 Microsoft Windows NT Enterprise Server 4.0 Microsoft Windows NT 3.5.1 Microsoft Windows 95 Marconi ATM Switch 7.0.1 Marconi ATM Switch 6.1.1 Linux kernel 2.0.31 Linux kernel 2.0.30 HP HP-UX (VVOS) 10.24 HP HP-UX 11.0 HP HP-UX 10.30 HP HP-UX 10.20 HP HP-UX 10.16 HP HP-UX 10.10 HP HP-UX 10.1 0 HP HP-UX 10.0 1 HP HP-UX 10.0 HP HP-UX 9.0 FreeBSD FreeBSD 2.2.5 FreeBSD FreeBSD 2.2.4 FreeBSD FreeBSD 2.2.3 FreeBSD FreeBSD 2.2 FreeBSD FreeBSD 2.1.6 .1 FreeBSD FreeBSD 2.1.6 FreeBSD FreeBSD 2.1.5 FreeBSD FreeBSD 2.1 x FreeBSD FreeBSD 2.1 Cisco IOS/700 1.0 Cisco IOS 11.2 Cisco IOS 11.1 Cisco IOS 11.0 Cisco IOS 10.3 BSDI BSD/OS 2.1 BSDI BSD/OS 2.0.1 BSDI BSD/OS 2.0 BSDI BSD/OS 1.1 Avaya Modular Messaging (MAS) 3.0

Not Vulnerable:	NetBSD NetBSD 1.3.2 NetBSD NetBSD 1.3.1 NetBSD NetBSD 1.3 Microsoft Windows NT Workstation 4.0 SP4 Microsoft Windows NT Terminal Server 4.0 SP4 Microsoft Windows NT Server 4.0 SP4 Microsoft Windows NT Enterprise Server 4.0 SP4 Linux kernel 2.2.10 + Caldera OpenLinux 2.3 Linux kernel 2.2 Linux kernel 2.1 .x Linux kernel 2.1 Linux kernel 2.0.38 Linux kernel 2.0.37 Linux kernel 2.0.36 Linux kernel 2.0.35 Linux kernel 2.0.34 Linux kernel 2.0.33 Linux kernel 2.0.32 FreeBSD FreeBSD 2.2.8 FreeBSD FreeBSD 2.2.6 FreeBSD FreeBSD 2.2.2 FreeBSD FreeBSD 3.x Cisco IOS 11.2.10 Cisco IOS 11.2.9 P Cisco IOS 11.2.4 F1 Cisco IOS 11.2.4 F Cisco IOS 11.2.4 Cisco IOS 11.1.15 IA Cisco IOS 11.1.15 CA Cisco IOS 11.1.15 AA Cisco IOS 11.1.15 Cisco IOS 11.1.9 IA Cisco IOS 11.1.7 CA Cisco IOS 11.1.7 AA Cisco IOS 11.1.7 Cisco IOS 11.0.17 BT Cisco IOS 11.0.17 Cisco IOS 11.0.12 (a)BT Cisco IOS 10.3.19 a Cisco IOS 10.3.16 Cisco Catalyst 29xx supervisor software 2.4.401 Cisco Catalyst 29xx supervisor software 2.1.1102 BSDI BSD/OS 4.0.1 BSDI BSD/OS 4.0 BSDI BSD/OS 3.1 BSDI BSD/OS 3.0

Discussion

Microsoft IPv6 TCP/IP Loopback LAND Denial of Service Vulnerability

The Microsoft Windows IPv6 TCP/IP stack is prone to a 'loopback' condition initiated by sending a TCP packet with the 'SYN' flag set and the source address and port spoofed to equal the destination source and port.

When a packet of this type is handled, an infinite loop is initiated and the affected system halts.

A remote attacker may exploit this issue to deny service for legitimate users.

Exploit / POC

Microsoft IPv6 TCP/IP Loopback LAND Denial of Service Vulnerability

The following exploit is available:

/data/vulnerabilities/exploits/imland.c
/data/vulnerabilities/exploits/r57windos.c
/data/vulnerabilities/exploits/land.c
/data/vulnerabilities/exploits/latierra.c
/data/vulnerabilities/exploits/LandIpV6.cpp

Solution / Fix

Microsoft IPv6 TCP/IP Loopback LAND Denial of Service Vulnerability

Solution:
Microsoft has released advisories and fixes to address this issue. Please see the referenced advisories for more information on obtaining and applying fixes.

Microsoft Windows Server 2003 Datacenter Edition SP1