5 ms·
Critical: Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution
- tsally 17y agoWhenever I see a bug this serious I always wonder if it's been floating around in the wild all this time.
- fnid 17y agoOf course. I doubt they just introduced it, considering it affects operating systems stretching back a decade.
- huhtenberg 17y agoWell, actually no, not a decade. Remote execution vulnerability was clearly introduced in Vista, most likely due to the much touted network stack rewrite.
- tsally 17y agoI wasn't referring to security researchers. I'd be more interested in someone sitting on it as a zero day.
- tptacek 17y agoI reallllllllly want to know if the TCP/IP Timestamp Options vulnerability --- the one where they keep a stale function pointer in memory that winds up controlled by an attacker --- refers to the IP Timestamps Option or the TCP Timestamp Option. The IP Timestamp Option is more likely --- it's crazy complicated (among other things, you can play tricks with IP timestamps to determine whether two IP addresses are virtually hosted on the same machine). The good news about IP Timestamps is your router probably doesn't pass packets that have that option set.
- huhtenberg 17y agoThere is a good chance that they just put the pointer itself in a timestamp field, presumably allowing the responder to tweak it to point at something else.
- tptacek 17y agoMy read of the advisory was that it's a memory lifecycle issue --- having to do, as the advisory said, with not cleaning up state properly. Which, come to think about it, suggests that it's TCP timestamps --- IP timestamps are stateless.
- stse 17y agoThis is the most detailed description I could find - http://blogs.technet.com/srd/archive/2009/09/08/ms09-048-tcp-ip-vulnerabilities.aspx http://blogs.technet.com/srd/archive/2009/09/08/ms09-048-tcp...
- yan 17y agoAn FYI, if you guys care about more passive attacks that let you deduce the source of NAT'ed packets and other tricks, check out "Silence on the Wire" by Zaelwski. Awesome read.
- cturner 17y agoDoes the vulnerability stretch back into any of the BSDs it was forked from? :)
- wglb 17y agoNow that is almost mean.
- cperciva 17y agoAs FreeBSD Security Officer I don't see anything unreasonable about that question -- it's the first thing which occurred to me, too.
- spamizbad 17y agoActually unlike the previous TCP/IP stack I believe the Vista/Win7/Serv2008 stack is new from the ground-up.
- _ck_ 17y agoThey rewrote it so carefully that they duplicated the same teardrop bug they created back in windows 3.1/95 and didn't fix for half a decade.
- cperciva 17y agoGood question -- but I have to say "almost certainly not", for two reasons. First, I haven't had any email from Microsoft about this -- and for all that Microsoft has a reputation for being bad at security and not supporting open source software, they do take their responsibilities seriously when it comes to inter-vendor coordination. Second, the details I've seen relating to this suggest that it relates to connection hashing -- which is relatively new, and thus is unlikely to involve code from the BSD stack which Microsoft imported so many years ago.
- huhtenberg 17y agoNote how XP does not have this particular vulnerability.
- mqatrombone 17y agoXP is affected by this but XP is not vulnerable in the default configuration because there is no service listening set up with the firewall by default and the firewall is on by default. I am curious to see if this causes problems for Microsoft down the road.
- NathanKP 17y agoI wonder if this particular vulnerability can be stopped by a firewall.
- GrandMasterBirt 17y agoSo what? MS found a security bug. Lets look on linux forms about all the security exploits fixed here and there. MS fixed a critical bug. Yay. Why complain? Its better than Apple ignoring security bugs for years :)
- stse 17y agoYes, this is basically "update as usual". The bugs one should be concerned about is the ones that are public, but does not have any patches.
- thaumaturgy 17y agoRemote code execution vulnerabilities on widely-used systems is generally noteworthy.
- milkshakes 17y agowho said anything about complaining?
- cool-RR 17y agoI thought that was the title of all Windows hotfixes.
- mmainguy 17y agoYou know, I just don't get it, Microsoft is reputed to hire pretty smart people, but somehow this slips through? This is on the border of professionally negligent. I can see if my foomatic open source project allows someone to run remote code (hell, even IIS or maybe apache for that matter), but the TCPIP stack itself? sheesh....
- swolchok 17y agoIt's hard to find this sort of thing statically in C code, especially if your static analysis tool is configured to treat C typecasts as necessarily correct because there's no syntax in C for expressing how dangerous a cast you intended, unlike C++. Of course, I don't know whether this code is C or C++.