Signature Detail
Short Name |
DNS:OVERFLOW:TCP-RESPONSE |
|---|---|
Severity |
Critical |
Recommended |
No |
Recommended Action |
Drop |
Category |
DNS |
Keywords |
TCP Response Buffer Overflow |
Release Date |
2004/10/15 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
DNS: TCP Response Buffer Overflow
This signature detects a DNS response sent over TCP that contains an excessive number of IP addresses (more than 100) for a single name query. A DNS response with too many addresses can overflow a buffer in certain Windows operating system versions as well as the Exchange mail server.
Extended Description
The Microsoft Windows 2003 SMTP Service and Exchange Routing Engine have been reported prone to a buffer overflow. This occurs during the processing responses to DNS lookups. Successful exploitation could allow for remote code execution in the context of the vulnerable service.
Affected Products
- Avaya DefinityOne Media Servers
- Avaya IP600 Media Servers
- Avaya Modular Messaging (MSS) 1.1.0
- Avaya Modular Messaging (MSS) 2.0.0
- Avaya S3400 Message Application Server
- Avaya S8100 Media Servers
- Microsoft Exchange Server 2000 SP1
- Microsoft Exchange Server 2000 SP2
- Microsoft Exchange Server 2000 SP3
- Microsoft Exchange Server 2000
- Microsoft Exchange Server 2003
- Microsoft Windows Server 2003 Datacenter Edition
- Microsoft Windows Server 2003 Datacenter Edition Itanium
- Microsoft Windows Server 2003 Enterprise Edition
- Microsoft Windows Server 2003 Enterprise Edition Itanium
- Microsoft Windows Server 2003 Standard Edition
- Microsoft Windows Server 2003 Web Edition
- Microsoft Windows XP 64-bit Edition Version 2003 SP1
- Microsoft Windows XP 64-bit Edition Version 2003
References
- BugTraq: 11374
- CVE: CVE-2004-0840
- URL: http://www.microsoft.com/technet/security/Bulletin/MS04-035.mspx