Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution
Description: This security update resolves several privately reported vulnerabilities in Transmission Control Protocol/Internet Protocol (TCP/IP) processing. The vulnerabilities could allow remote code execution if an attacker sent specially crafted TCP/IP packets over the network to a computer with a listening service. Firewall best practices and standard default firewall configurations can help protect networks from attacks that originate outside the enterprise perimeter. Best practices recommend that systems that are connected to the Internet have a minimal number of ports exposed. The security update addresses the vulnerabilities by dropping existing TCP connections adaptively and limiting the number of new TCP connections until system resources are restored, and changing the manner in which TCP/IP packets are processed.
Update type: Critical
Release date: September 8, 2009
Applies to: All versions
Knowledge base: http://support.microsoft.com/kb/967723
- TCP/IP Zero Window Size Vulnerability – CVE-2008-4609
- TCP/IP Timestamps Code Execution Vulnerability – CVE-2009-1925
- TCP/IP Orphaned Connections Vulnerability – CVE-2009-1926
For more information on this issue, including potential causes, workarounds, and resolutions, see: Microsoft KB Article KB967723.