FragmentSmack vulnerability also affects Windows, but Microsoft patched it!!!

By -
FragmentStack can drive CPU usage up through the roof, jamming servers bombarded with malformed IP packets. Just the ideal vulnerability for DDoS attacks on Windows servers.
Microsoft has fixed this week a vulnerability that can cause Windows systems to become unresponsive with 100% CPU utilization when bombarded with malformed IPv4 or IPv6 packets.The vulnerability is already well known in the Linux community as FragmentSmack, part of a duo of DDoS-friendly vulnerabilities, together with SegmentSmack.
Both vulnerabilities allow an attacker to bombard a server with malformed packets to trigger excessive resource usage.The SegmentSmack (CVE-2018-5390) vulnerability uses malformed TCP packets, while the FragmentSmack (CVE-2018-5391) vulnerability relies on IP packets.
Because of their consequences, both bugs were deemed ideal to integrate into DDoS botnets, and as a result, many Linux distros hurried to patch their systems.
The Linux Kernel team patched both issues in July and August --patches that flowed into the downstream Linux community-- and US Computer Emergency Readiness Team (CERT) released an advisory in mid-August, warning cloud and hosting service providers to update systems as soon as possible.
At the time, in mailing lists carrying discussions about the two vulnerabilities, Juha-Matti Tilli of Nokia Labs and the Department of Communications and Networking at the Aalto University, the researcher who discovered both flaws, said the two bugs might also affect macOS and Windows.
This week, Microsoft confirmed that Windows was, indeed, vulnerable to FragmentSmack. Fixes were deployed to all Windows supported versions, such as 7, 8.1, 10, and all the Windows Server variants, as part as security advisory ADV180022, released with the company's monthly security updates train, known as Patch Tuesday.
Just like on Linux, FragmentSmack affects Windows systems in the same way, and drives CPU usage to 100%, blocking activity on the attacked system until the attacker stops sending malformed IP packets. While desktop users will rarely see a FragmentSmack attack, admins of Windows-based servers should apply the latest fixes at their earliest convenience.
The ADV180022 advisory also includes some mitigations that will stop FragmentSmack attacks from jamming a server, in case patches can't be applied right away.
Microsoft says its Azure infrastructure has already been reinforced against this threat. The OS maker did not provide any additional details about FragmentSmack's twin vulnerability --SegmentSmack-- but if we are to believe Tilli, that flaw might work against Windows systems as well.

Comments

Post a Comment

Popular Posts

Hacker steals data of millions of Bulgarians, emails it to local media

By -
Image
  Source of the data breach appears to be the country's National Revenue Agency A mysterious hacker has stolen the personal details of millions of Bulgarians and has emailed download links to the stolen data to local news publications. The data's origin is believed to be the country's National Revenue Agency (NRA), a department of the Bulgarian Ministry of Finance. In a  message posted on its website  on Monday, the NRA said it was working with the Ministry of the Interior and the State Agency for National Security (SANS) to investigate the hack. "We are currently verifying whether the data is real," said the NRA. Hours after this article's publication, the Bulgarian Ministry of the Interior  confirmed the hack . HACKER STOLE 110 DATABASES, LEAKED 57 According to reports from local media [ 1 ,  2 ,  3 ,  4 ,  5 ], who received part of the data, the hacker said they stole the personal details of over five million Bulgarians, of the country's total ...
Read more

​Linux totally dominates supercomputers

By -
Image
It finally happened. Today, all 500 of the world's top 500 supercomputers are running Linux. Linux rules supercomputing. This day has been coming since 1998, when Linux first appeared on the TOP500 Supercomputer list . Today it finally happened:  All 500 of the world's fastest supercomputers are running Linux . The last two non-Linux systems, a pair of Chinese IBM POWER computers running AIX, dropped off the  November 2017 TOP500 Supercomputer list . Overall, China now leads the supercomputing race with 202 computers to the US' 144. China also leads the US in aggregate performance. China's supercomputers represent 35.4 percent of the Top500's flops, while the US trails with 29.6 percent. With an anti-science regime in charge of the government, America will only continue to see its technological lead decline. When the  first Top500 supercomputer list was compiled in June 1993 , Linux was barely more than a toy. It hadn't even adopted Tux as its masc...
Read more

Microsoft tries to stem its self-made collaboration-tool confusion

By -
Image
Microsoft is using this week's Ignite conference to try to help clarify its collaboration-tool strategy. Here's how SharePoint, Teams and Yammer figure in the mix. Choice is good. But too much choice, especially when it comes to collaboration tools, has been a problem for Microsoft. This isn't news to customers, partners or Microsoft execs themselves. But at the company's Ignite IT Pro conference in Orlando this week, Microsoft execs took a step to try to clarify the company's strategy and messaging in this area. Microsoft Office 365 Marketing chief Ron Markezich kicked off the conference this week with a slide entitled "Microsoft 365 Teamwork: Where to Start a Conversation." That slide attempts to do what  Microsoft initially attempted with a 60-plus-page whitepaper : Clarify which collaboration tools customers should use when. The slide, which features SharePoint -- and its files, sites and content storage at the center -- is broken down into t...
Read more