ICMP Microsoft Windows TCP-IP Stack ICMP Sequence Denial of Service (CVE-2011-1871)

Rule ID

1055299

Severity

High

Description

Tcpip.sys in the TCP/IP stack in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to cause a denial of service (reboot) via a series of crafted ICMP messages, aka "ICMP Denial of Service Vulnerability.

Impact

An attacker sends a sequence of specially crafted Internet Control Message Protocol (ICMP) messages to a target system or sends a specially crafted URL request to a server that is serving Web content and has the URL-based (QoS) feature feature enabled.

Recommendation

Update vendor's patch.

IPS Category

Buffer Overflow

IPS Anomaly Group

N/A

IPS Rule Default Action

Deny

References

Keywords

Windows 7, Windows Server 2008, Windows Vista