CVE-1999-0875 : Détail

CVE-1999-0875

A05-Security Misconfiguration
1.49%V3
Network
2000-01-18
04h00 +00:00
2024-08-01
16h55 +00:00
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

DHCP clients with ICMP Router Discovery Protocol (IRDP) enabled allow remote attackers to modify their default routes.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-16 Category : Configuration
Weaknesses in this category are typically introduced during the configuration of the software.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Informations sur l'Exploit

Exploit Database EDB-ID : 19451

Date de publication : 1999-08-10 22h00 +00:00
Auteur : L0pth
EDB Vérifié : Yes

source: https://www.securityfocus.com/bid/578/info [This discussion is verbatim from the LHI Advisory referenced in the "Reference Section" of this vulnerability entry with very few changes] The ICMP Router Discovery Protocol (IRDP) comes enabled by default on DHCP clients that are running Microsoft Windows95 (w/winsock2), Windows95b, Windows98, Windows98se, and Windows2000 machines. By spoofing IRDP Router Advertisements, an attacker can remotely add default route entries on a remote system. The default route entry added by the attacker will be preferred over the default route obtained from the DHCP server. This results in higher susceptibility to denial of service, passive snooping and man in the middle attacks. While Windows 2000 does indeed have IRDP enabled by default, it is less vulnerable as it is impossible to give it a route that is preferred over the default route obtained via DHCP. SunOS systems will also intentionally use IRDP under specific conditions. For Solaris2.6, the IRDP daemon, in.rdisc, will be started if the following conditions are met: The system is a host, not a router. The system did not learn a default gateway from a DHCP server. The system does not have any static routes. The system does not have a valid /etc/defaultrouter file. L0pht (LHI) has made available Proof-of-Concept code that will let individuals test their systems & firewalls. Usage is as follows: Usage: rdp -v -l -s -d <delay> -p <pref> -t <lifetime> -i <dev> -S <src> -D <dst> -R <rtr> -r <optional 2nd rtr> -v verbose -l listen mode -s send mode -d <delay time between sending packets> -n <number of rdp packets to send> -I <ID value to place in IP packet> -p <preference level> -t <lifetime> -i <interface to use for sniffing> -S <source address to put in outgoing rdp packet> -D <destination address to put in outgoing rdp packet> -R <router address to advertise in rdp packet> -r <optional 2nd router address to advertise in rdp packet> Misc software notes: Listen Mode: Software listens for ICMP Router Solicitations. If the '-s' flag is specified as well, the software will answer the Solicitations with ICMP Router Advertisements. Preference: If the preference is not specified, it will use a default of 1000, which will give the default route a metric of 0 on affected Windows systems. 2nd Router Addr: By using the '-r' flag and specifying a second router address entry, the packet can contain a bogus source address and still be processed for correct gateway entries by the end host. https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19451.tar.gz

Products Mentioned

Configuraton 0

Microsoft>>Windows_2000 >> Version *

Microsoft>>Windows_95 >> Version 0a

    Microsoft>>Windows_95 >> Version 0b

      Microsoft>>Windows_98se >> Version *

      Sun>>Solaris >> Version 2.6

      Sun>>Sunos >> Version -

      Références

      http://www.securityfocus.com/bid/578
      Tags : vdb-entry, x_refsource_BID