The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 does not properly manage state information, which allows remote attackers to execute arbitrary code by sending packets to a listening service, and thereby triggering misinterpretation of an unspecified field as a function pointer, aka "TCP/IP Timestamps Code Execution Vulnerability."

According to the version number obtained by NTLM the remote host has Windows Server 2008 installed. The host may be vulnerable to a number of vulnerabilities including remote unauthenticated code execution.

The TCP/IP implementation on the remote host has multiple flaws that could allow remote code execution if an attacker sent specially crafted TCP/IP packets over the network to a computer with a listening service :

  - A denial of service vulnerability exists in TCP/IP     processing in Microsoft Windows due to the way that     Windows handles an excessive number of established TCP     connections. The affect of this vulnerability can be     amplified by the requirement to process specially     crafted packets with a TCP receive window size set to a     very small value or zero. An attacker could exploit the     vulnerability by flooding a system with specially     crafted packets causing the affected system to stop     responding to new requests or automatically restart.
    (CVE-2008-4609)

  - A remote code execution vulnerability exists in the     Windows TCP/IP stack due to the TCP/IP stack not     cleaning up state information correctly. This causes the     TCP/IP stack to reference a field as a function pointer     when it actually contains other information. An anonymous     attacker could exploit the vulnerability by sending     specially crafted TCP/IP packets to a computer that has     a service listening over the network. An attacker who     successfully exploited this vulnerability could take     complete control of an affected system. (CVE-2009-1925)

  - A denial of service vulnerability exists in TCP/IP     processing in Microsoft Windows due to an error in the     processing of specially crafted packets with a small or     zero TCP receive window size. If an application closes a     TCP connection with pending data to be sent and an     attacker has set a small or zero TCP receive window     size, the affected server will not be able to     completely close the TCP connection. An attacker could     exploit the vulnerability by flooding a system with     specially crafted packets causing the affected system     to stop responding to new requests. The system would     remain non-responsive even after the attacker stops     sending malicious packets. (CVE-2009-1926)

ID	Name	Product	Family	Severity
108811	Windows Server 2008 Critical RCE Vulnerabilities (uncredentialed) (PCI/DSS)	Nessus	Windows	critical
40891	MS09-048: Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (967723)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2009-1925

critical

Tenable Plugins

critical

high