Vulnerability Alert

Multiple products contain a vulnerability that could allow an unauthenticated, remote attacker to exhaust available TCP and IP connections, resulting in a denial of service (DoS) condition.

This vulnerability exists due to improper handling of malformed TCP and IP packets.  An unauthenticated, remote attacker could exploit this vulnerability by establishing a large number of TCP and IP connections with a vulnerable system.  If successful, the attacker could prevent the system from accepting new connections, resulting in a DoS condition.

Check Point, Cisco, McAfee, Microsoft, Stonesoft and Citrix have confirmed this vulnerability and released software updates. Sun and Nortel have also confirmed this vulnerability, but software updates are not available.

Cisco has published a list of affected Cisco IOS Software releases in the security advisory.  Versions of Cisco PIX and ASA Software, Cisco CatOS Software, and Cisco IOS-XE Software are also affected, as listed in the security advisory.  The Vendor Announcements section of this alert contains a link to the advisory.

The following Microsoft systems are affected:

• Windows 2000 SP4 and prior
• Windows XP SP3 and prior
• Windows XP Professional x64 Edition SP2 and prior
• Windows Server 2003 SP2
• Windows Server 2003 x64 Edition SP2
• Windows Server 2003 for Itanium-based Systems SP2
• Windows Vista SP2 and prior
• Windows Vista x64 Edition SP2 and prior
• Windows Server 2008 for 32-bit Systems SP2 and prior
• Windows Server 2008 for x64-based Systems SP2 and prior
• Windows Server 2008 for Itanium-based Systems SP2 and prior

Vulnerable Nortel products are listed in the Nortel advisory that is available in the vendor announcements section of this alert.

The following Stonesoft products are vulnerable:

• StoneGate Firewall and VPN engines versions 4.2.10 and prior and versions 4.3.0 through 5.0.2
• StoneGate IPS engine versions 4.2.3 and prior, 4.3.6 and prior and 5.0.1 and prior
• StoneGate SSL VPN versions 1.3.1 and prior

The following Sun products are vulnerable:

SPARC
Solaris 8
Solaris 9
Solaris 10

Intel
Solaris 8
Solaris 9
Solaris 10

To exploit this vulnerability, an attacker must establish a complete TCP three-way handshake to establish a connection to a vulnerable system. The establishment of a complete session requires additional resources on the part of an attacker, increasing the time that may be required for exploitation. Additionally, some network devices or end hosts may not accept direct connections from untrusted sources, reducing the chance of exploitation.

Although Microsoft has confirmed this vulnerability in Windows 2000 and Windows XP, updates for these operating systems will not be released.

Cisco has re-released a security advisory to state that Cisco PIX and Cisco ASA security appliances versions 7.0.x are not affected by this vulnerability.

An exploit could prevent a targeted system from establishing any additional incoming TCP and IP connections. Some devices, such as perimeter network filtering devices, may be rendered completely unavailable as the result of exploitation. Other systems, particularly end-user hosts, may be impacted to a lesser extent, as these systems rarely accept critical incoming network connections.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.

The Cisco Applied Intelligence team has created an Applied Mitigation Bulletin to address vulnerabilities that Microsoft disclosed in the September 2009 security bulletin release. This Cisco bulletin, which assists administrators in identifying or mitigating these vulnerabilities using Cisco devices, is available at the following link: Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin Release for September 2009

Check Point has released a security advisory at the following link: CVE-2008-4609

Cisco has re-released a security advisory to address Cisco bug IDs CSCsv04836, CSCsv07712, CSCsv66169, CSCsv02768, CSCsv08325, CSCsv08579 at the following link: cisco-sa-20090908-tcp24

Citrix has released a security notice at the following link: CTX123649

McAfee has released a security advisory at the following link: CVE-2008-4609

Microsoft has released a security bulletin at the following link: MS09-048

Nortel has released a security advisory at the following link: Nortel Enterprise Response to Sockstress TCP DoS

Stonesoft has released a security advisory at the following link: StoneGate Engines Vulnerable to Sockstress Denial-of-Service Tool

Sun has released an alert notification at the following link: 267088