The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.

According to the version number obtained by NTLM the remote host has Windows Server 2008 installed. The host may be vulnerable to a number of vulnerabilities including remote unauthenticated code execution.

Sockstress DoS tool CVE-2008-4609. The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.

Multiple Cisco products are affected by denial of service (DoS) vulnerabilities that manipulate the state of Transmission Control Protocol (TCP) connections. By manipulating the state of a TCP connection, an attacker could force the TCP connection to remain in a long-lived state, possibly indefinitely. If enough TCP connections are forced into a long-lived or indefinite state, resources on a system under attack may be consumed, preventing new TCP connections from being accepted. In some cases, a system reboot may be necessary to recover normal system operation. To exploit these vulnerabilities, an attacker must be able to complete a TCP three-way handshake with a vulnerable system.
In addition to these vulnerabilities, Cisco Nexus 5000 devices contain a TCP DoS vulnerability that may result in a system crash. This additional vulnerability was found as a result of testing the TCP state manipulation vulnerabilities.
Cisco has released free software updates for download from the Cisco website that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available.

The TCP/IP implementation on the remote host has multiple flaws that could allow remote code execution if an attacker sent specially crafted TCP/IP packets over the network to a computer with a listening service :

  - A denial of service vulnerability exists in TCP/IP     processing in Microsoft Windows due to the way that     Windows handles an excessive number of established TCP     connections. The affect of this vulnerability can be     amplified by the requirement to process specially     crafted packets with a TCP receive window size set to a     very small value or zero. An attacker could exploit the     vulnerability by flooding a system with specially     crafted packets causing the affected system to stop     responding to new requests or automatically restart.
    (CVE-2008-4609)

  - A remote code execution vulnerability exists in the     Windows TCP/IP stack due to the TCP/IP stack not     cleaning up state information correctly. This causes the     TCP/IP stack to reference a field as a function pointer     when it actually contains other information. An anonymous     attacker could exploit the vulnerability by sending     specially crafted TCP/IP packets to a computer that has     a service listening over the network. An attacker who     successfully exploited this vulnerability could take     complete control of an affected system. (CVE-2009-1925)

  - A denial of service vulnerability exists in TCP/IP     processing in Microsoft Windows due to an error in the     processing of specially crafted packets with a small or     zero TCP receive window size. If an application closes a     TCP connection with pending data to be sent and an     attacker has set a small or zero TCP receive window     size, the affected server will not be able to     completely close the TCP connection. An attacker could     exploit the vulnerability by flooding a system with     specially crafted packets causing the affected system     to stop responding to new requests. The system would     remain non-responsive even after the attacker stops     sending malicious packets. (CVE-2009-1926)

ID	Name	Product	Family	Severity
108811	Windows Server 2008 Critical RCE Vulnerabilities (uncredentialed) (PCI/DSS)	Nessus	Windows	critical
78121	F5 Networks BIG-IP : Sockstress DoS tool vulnerability (SOL10509)	Nessus	F5 Networks Local Security Checks	high
49038	TCP State Manipulation Denial of Service Vulnerabilities in Multiple Cisco Products - Cisco Systems	Nessus	CISCO	high
40891	MS09-048: Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (967723)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2008-4609

high

Tenable Plugins

critical

high

high

high