PT-2013-4168 · Microsoft · Windows Rt+6

Published 2013-06-11 · Updated 2023-12-07 · CVE-2013-3138

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue is related to an integer overflow in the TCP/IP kernel-mode driver, which allows remote attackers to cause a denial of service, resulting in a system hang, via crafted TCP packets. A denial of service vulnerability exists in the way that the Windows TCP/IP driver improperly handles packets during TCP connection, allowing an attacker to cause the target system to stop responding.

Recommendations For Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT, update to a version that includes the fix for the TCP/IP Integer Overflow issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2013-3138

Affected Products

Windows

Windows 7

Windows 8

Windows Rt

Windows Server 2008

Windows Server 2012

Windows Vista

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-3138 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3138 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-049 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16943 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-049 · Note
• http://us-cert.gov/ncas/alerts/TA13-168A · Note