News for hackers. Stuff that matters.

A comment on Critical: Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution.

Re:Critical: Vulnerabilities in Windows TCP/IP Could Allow R... by tptacek on Thursday September 10, 2009 @10:49AM (#815338)
I reallllllllly want to know if the TCP/IP Timestamp Options vulnerability --- the one where they keep a stale function pointer in memory that winds up controlled by an attacker --- refers to the IP Timestamps Option or the TCP Timestamp Option.

The IP Timestamp Option is more likely --- it's crazy complicated (among other things, you can play tricks with IP timestamps to determine whether two IP addresses are virtually hosted on the same machine). The good news about IP Timestamps is your router probably doesn't pass packets that have that option set.

[ Parent | on HN ]
Re:Critical: Vulnerabilities in Windows TCP/IP Could Allow R... by stse on Thursday September 10, 2009 @12:02PM (#815497)
This is the most detailed description I could find - http://blogs.technet.com/srd/archive/2009/09/08/ms09-048-tcp...
[ Parent | on HN ]
Re:Critical: Vulnerabilities in Windows TCP/IP Could Allow R... by yan on Thursday September 10, 2009 @01:14PM (#815669)
An FYI, if you guys care about more passive attacks that let you deduce the source of NAT'ed packets and other tricks, check out "Silence on the Wire" by Zaelwski. Awesome read.
[ Parent | on HN ]
Re:Critical: Vulnerabilities in Windows TCP/IP Could Allow R... by huhtenberg on Thursday September 10, 2009 @11:40AM (#815447)
There is a good chance that they just put the pointer itself in a timestamp field, presumably allowing the responder to tweak it to point at something else.
[ Parent | on HN ]
Re:Critical: Vulnerabilities in Windows TCP/IP Could Allow R... by tptacek on Thursday September 10, 2009 @12:23PM (#815545)
My read of the advisory was that it's a memory lifecycle issue --- having to do, as the advisory said, with not cleaning up state properly. Which, come to think about it, suggests that it's TCP timestamps --- IP timestamps are stateless.
[ Parent | on HN ]