Title: Multiple Vendor loopback (land.c) Denial of Service Vulnerability
Severity: HIGH
Description:
A number of TCP/IP stacks are vulnerable to a "loopback" condition initiated by sending a TCP packet with the "SYN" flag set and the source address and port spoofed to equal the destination source and port. When a packet of this sort is received, an infinite loop is initiated and the affected system halts. This is known to affect Windows 95, Windows NT 4.0 up to SP3, Windows Server 2003, Windows XP SP2, Cisco IOS devices & Catalyst switches, and HP-UX up to 11.00.
It is noted that on Windows Server 2003 and XP SP2, the TCP and IP checksums must be correct to trigger the issue.
**Update: It is reported that Microsoft platforms are also prone to this vulnerability. The vendor reports that network routers may not route malformed TCP/IP packets used to exploit this issue. As a result, an attacker may have to discover a suitable route to a target computer, or reside on the target network segment itself before exploitation is possible.
Affected Products:
- BSDI BSD/OS 1.1.0
- BSDI BSD/OS 2.0.0
- BSDI BSD/OS 2.0.1
- BSDI BSD/OS 2.1.0
- Cisco IOS 10.3
- Cisco IOS 11.0
- Cisco IOS 11.1
- Cisco IOS 11.2
- Cisco IOS/700 1.0.0
- FreeBSD FreeBSD 2.1.0
- FreeBSD FreeBSD 2.1.0 x
- FreeBSD FreeBSD 2.1.5
- FreeBSD FreeBSD 2.1.6
- FreeBSD FreeBSD 2.1.6 .1
- FreeBSD FreeBSD 2.2.0
- FreeBSD FreeBSD 2.2.3
- FreeBSD FreeBSD 2.2.4
- FreeBSD FreeBSD 2.2.5
- HP HP-UX (VVOS) 10.24.0
- HP HP-UX 10.0.0
- HP HP-UX 10.0.0 1
- HP HP-UX 10.1.0 0
- HP HP-UX 10.10.0
- HP HP-UX 10.16.0
- HP HP-UX 10.20.0
- HP HP-UX 10.30.0
- HP HP-UX 11.0.0
- HP HP-UX 9.0.0
- Linux kernel 2.0.30
- Linux kernel 2.0.31
- Marconi ATM Switch 6.1.1
- Marconi ATM Switch 7.0.1
- Microsoft Windows 95
- Microsoft Windows NT 3.5.1
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP3 alpha
- Microsoft Windows NT Enterprise Server 4.0
- Microsoft Windows NT Enterprise Server 4.0 SP1
- Microsoft Windows NT Enterprise Server 4.0 SP2
- Microsoft Windows NT Enterprise Server 4.0 SP3
- Microsoft Windows NT Server 4.0
- Microsoft Windows NT Server 4.0 SP1
- Microsoft Windows NT Server 4.0 SP2
- Microsoft Windows NT Server 4.0 SP3
- Microsoft Windows NT Terminal Server 4.0
- Microsoft Windows NT Terminal Server 4.0 SP1
- Microsoft Windows NT Terminal Server 4.0 SP2
- Microsoft Windows NT Terminal Server 4.0 SP3
- Microsoft Windows NT Workstation 4.0
- Microsoft Windows NT Workstation 4.0 SP1
- Microsoft Windows NT Workstation 4.0 SP2
- Microsoft Windows NT Workstation 4.0 SP3
- Microsoft Windows Server 2003 Datacenter Edition
- Microsoft Windows Server 2003 Datacenter Edition Itanium
- Microsoft Windows Server 2003 Datacenter Edition Itanium SP1
- Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Beta 1
- Microsoft Windows Server 2003 Datacenter Edition SP1
- Microsoft Windows Server 2003 Datacenter Edition SP1 Beta 1
- Microsoft Windows Server 2003 Enterprise Edition
- Microsoft Windows Server 2003 Enterprise Edition Itanium
- Microsoft Windows Server 2003 Enterprise Edition Itanium SP1
- Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Beta 1
- Microsoft Windows Server 2003 Enterprise Edition SP1
- Microsoft Windows Server 2003 Enterprise Edition SP1 Beta 1
- Microsoft Windows Server 2003 Standard Edition
- Microsoft Windows Server 2003 Standard Edition SP1
- Microsoft Windows Server 2003 Standard Edition SP1 Beta 1
- Microsoft Windows Server 2003 Web Edition
- Microsoft Windows Server 2003 Web Edition SP1
- Microsoft Windows Server 2003 Web Edition SP1 Beta 1
- Microsoft Windows XP 64-bit Edition
- Microsoft Windows XP 64-bit Edition SP1
- Microsoft Windows XP 64-bit Edition Version 2003
- Microsoft Windows XP 64-bit Edition Version 2003 SP1
- Microsoft Windows XP Home
- Microsoft Windows XP Home SP1
- Microsoft Windows XP Home SP2
- Microsoft Windows XP Media Center Edition
- Microsoft Windows XP Media Center Edition SP1
- Microsoft Windows XP Media Center Edition SP2
- Microsoft Windows XP Professional
- Microsoft Windows XP Professional SP1
- Microsoft Windows XP Professional SP2
- Microsoft Windows XP Tablet PC Edition
- Microsoft Windows XP Tablet PC Edition SP1
- Microsoft Windows XP Tablet PC Edition SP2
- NetBSD NetBSD 1.0.0
- NetBSD NetBSD 1.1.0
- NetBSD NetBSD 1.2.0
- NetBSD NetBSD 1.2.1
- Novell Netware 4.1.0
- SCO CMW+ 3.0.0
- SCO Open Desktop 3.0.0
- SCO Open Server 5.0.0
- SCO Unixware 2.1.0
- Sun SunOS 4.1.3 _U1
- Sun SunOS 4.1.4
References:
- Cisco Systems: TCP Loopback DoS Attack (land.c) and Cisco Devices
- Dejan Levaja <dejan levaja com>: Windows Server 2003 and XP SP2 LAND attack vulnerability
- Microsoft: Microsoft Security Bulletin MS05-019
- Microsoft: Q165005 - Windows NT Slows Down Because of Land Attack
- Microsoft: Q177539 - Windows 95 Stops Responding Because of Land Attack
- Novell: TCP Loopback Denial-of-Service Attack
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
