MS09-048 is Microsoft's Revenge Against XP in the Enterprise

MS09-048 worries me.


Non-Affected Software

Operating System

Windows XP Service Pack 2 and Windows XP Service Pack 3*

How are default configurations of Windows XP not affected by this vulnerability?

By default, Windows XP Service Pack 2, Windows XP Service Pack 3, and Windows XP Professional x64 Edition Service Pack 2 do not have a listening service configured in the client firewall and are therefore not affected by this vulnerability. For the denial of service to succeed, an affected system must have a listening service with an exception in the client firewall. Windows XP Service Pack 2 and later operating systems include a stateful host firewall that provides protection for computers against incoming traffic from the Internet or from neighboring network devices on a private network.

Someone please tell me I am misinterpreting this. It looks to me like this is bad news for the enterprise that operates any listening services on their Windows XP systems. Oh, I don't know, maybe something like Microsoft SMB/CIFS? In other words, if you expose a service within the enterprise, and you allow other systems to connect to it, then you are vulnerable to MS09-048 -- and Microsoft isn't publishing a patch for XP SP2 or XP SP3?

What's worse is that I can't tell if XP SP2 or SP3 is vulnerable to this vulnerability in MS09-048:


TCP/IP Timestamps Code Execution Vulnerability - CVE-2009-1925

A remote code execution vulnerability exists in the Windows TCP/IP stack due to the TCP/IP stack not cleaning up state information correctly. This causes the TCP/IP stack to reference a field as a function pointer when it actually contains other information. An anonymous attacker could exploit the vulnerability by sending specially crafted TCP/IP packets to a computer that has a service listening over the network. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

So, at best we have an unpatched vulnerability that lets anyone in the enterprise remotely crash any XP SP2 and XP SP3 system with at least one listening service (139, 445 TCP) that the attacker can reach. At worst we have an unpatched vulnerability that lets anyone in the enterprise remotely exploit any XP SP2 and XP SP3 system with at least one listening service (139, 445 TCP) that the attacker can reach.

Does anyone know if TCP/IP Timestamps Code Execution Vulnerability - CVE-2009-1925 applies to XP SP2 or XP3?

Incidentally, running Microsoft Update on a Windows XP SP3 system does not show a patch for MS09-048 as available.

Comments

Unknown said…
Richard, thank you for posting this. I first read the MS08-048 bulletin and correctly alerted my team that this affects XP. Later in the day, I re-read it and got confused in that XP was listed in the non-affected category.

But my first read, and yours, is correct. Microsoft is just playing dumb by saying a default config has no listening services...but once a user gets on the system, it basically ends up with listening services almost without exception.

But your second question is very valid, and I wish I knew the answer. Basically, is XP then vulnerable to just a DOS or also the remote code exec?
10:43 AM
Anonymous said…
It is a confusing bulletin. The bulletin mentions DoS and potential code execution, but the latter is only relevant to CVE-2009-1925.
If you look at the "Vulnerability Severity Rating..." table you'll see that CVE-2009-1925 does not affect 2000, and 2003. I suppose this means that the vulnerability appeared on newer code introduced in Vista.

MS09-048 should still apply to XP for the two other DoS vulnerabilities and the reasons you mention.
11:12 AM
Roman said…
Does anyone have a link to the actual details of how this is exploited? I'd like to bang this against a couple XP boxes in our lab. All the stuff I'm coming up with is related to the media circus that went around prior to the talk on 17 Oct of last year.
11:34 AM
Brad said…
http://blogs.technet.com/srd/archive/2009/09/08/ms09-048-tcp-ip-vulnerabilities.aspx

Not sure if it really sheds light on much, but hopefully if people ask more questions they will post some follow-ups on the MS SRD blog.
2:27 PM
Anonymous said…
Is it correct that the vulnerability only manifests itself when you have configured a listening service in the firewall, and when the firewall service is operational? I get the impression you're equating a listening service independent of the firewall with the vulnerability.

I don't know if I agree with you regarding the revenge factor. Most large enterprises I have worked in don't use the Windows XP firewall (the 275,000 seat enterprise I work in now uses a 3rd party product). Microsoft probably knows this and while I like to vilify Microsoft whenever possible, I am not convinced that this particular circumstance is "part of the plan". If the vulnerability is only present when the firewall is configured and active, then I would suggest that not as many enterprises as one would suppose would be vulnerable.
3:57 PM
Richard Bejtlich said…
Anonymous, I think you have it backwards. Microsoft is not publishing an XP patch BECAUSE it assumes the "default config" has Windows Firewall denying inbound connections. Without Windows Firewall or any firewall denying all inbound connections to listening services, XP appears to be at least vulnerable to the DOS conditions.
4:21 PM
Unknown said…
Thanks for the link, Brad.

The blog mentions Toeplitz hash while talking about CVE-2009-1925.

The mention of hashing could be a clue that the vulnerability has its roots in RSS (Receive side scaling).

Here is my take on it. (Wild guess)

1. The hash is used by RSS to map flows to processors.

2. The hash is not the cheapest to compute. So it is calculated only if a listening service in userland responds to an incoming packet (eg, TCP syn). This explains the note by Richard that you need an exposed listening service. Any service will probably do.

3. Once computed for a flow the hash is probably stored in the TCP state structures. Since the hash always maps a TCP flow to the same value, looking up the precalculated hash presents opportunity for an optimization.

4. It might be possible to overflow the TCP control structures (TCBs) and the mapped hash values in such a way that will result in the lookup of an invalid hash. This might bugcheck because it trips in the kernel. Hence the system DoS.

This does not explain the role of TCP Timestamps in this exploit. Also no idea how it could be used for RCE.

What do others think ?
11:08 PM
Andrew from Vancouver said…
The bulletin has been updated to clarify that XP is affected, and that it recovers when the attack stops.

http://www.microsoft.com/technet/security/bulletin/ms09-048.mspx

No further mention that they won't be patching or why.
11:19 AM
Anonymous said…
I'd like some clarification on the "listening service" caveat: in my network, all XP machines have Windows Firewall enabled. The only exception is a incoming rule that allows the AVG server to connect to to TCP 4158. Would this allow any host to exploit this vulnerability or would the firewall drop the packets before it could be exploited?
11:16 AM
Richard Bejtlich said…
Anonymous, my understanding is that, unless the AVG server launched the attack, your hosts could not be reached and would therefore not be exposed to the DoS attacks.
4:36 PM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technical or pol
Read more