|
Microsoft Windows TCP Packet Information Disclosure
|
|
Secunia Advisory:
|
SA9799
|
|
|
Release Date:
|
2003-09-22
|
|
Popularity:
|
15,416 views
|
|
|
Critical:
|
Not critical
|
|
Impact:
|
Exposure of sensitive information
|
|
Where:
|
From remote
|
|
Solution Status:
|
Unpatched
|
|
| OS: | Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
Description:
A vulnerability has been identified in the handling of TCP packets in Microsoft Windows 2000 and Windows XP, which potentially can expose sensitive information.
The problem is that Windows under some circumstances doesn't clear the "URG" flag of TCP packets. When this happens Windows will not set the correct value for the 16 bit "URG" pointer value but may instead include random data from other data transfers.
This behaviour has been reported to affect Windows 2000 and XP with all the latest patches and updates. There is no report that this behaviour can be exploited unless data transfers are occuring at the same time.
This issue has been rated as "Not critical" since only a small amount of data may be revealed and because the issue can't be triggered by malicious people.
Solution:
There's no effective solution available.
Make sure that sensitive traffic is encrypted when transmitted.
Provided and/or discovered by:
Michal Zalewski
Other References:
Description of TCP header:
http://www.wickiup.com/wickiup/net/#tcp
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
