Servicetröt: Bitte einmal ganz fix alle eure #Windows Installationen updaten.

In meiner HTL Zeit hatten wir viel Spaß mit #PingOfDeath, diesmal gibt es auch viel Freude. Halt wieder nicht für die Opfer...

https://blog.fefe.de/?ts=9ae6e3ea

#cve202323415 #RCE

Re #cve202323415 , does anyone know if there's an easy way to identify the use of raw sockets on a Windows system? It might be possible to tease them out by finding listening ports using a port sweep and then comparing that with the list of listening ports from netstat. If they don't show up, then it's a raw socket. @GossiTheDog Thoughts?

Thinking about #cve202323415 How often is it really that server applications are actually bound to #RawSockets? I wouldn't think it was often except in rare cases where packet fu is being conducted. (Packet capture, custom tcp/IP stacks for network tools, pen test tools, etc.)

@GossiTheDog
Will netstat or any other command show if a process is specifically listening on a raw socket?

#cve202323415

I wrote about CVE-2023-23415, looking at the vuln + mitigations + threat intel. #CVE202323415

https://doublepulsar.com/a-look-at-cve-2023-23415-a-windows-icmp-vulnerability-mitigations-which-is-not-a-cyber-meltdown-78a9f7e3e538

Ping of (#RCE) Death?

#CVE202323415

Regarding #CVE202323415, I will be the vuln hype train deflater: I would wait for more technical info to emerge before pressing the panic button.

To me, it looks like it needs a third party app listening on raw sockets to be exploitable. That isn't true out of the box... and TCP raw sockets was disabled 19 years ago in Windows XP.

I suspect recreating exploitability may need something like Winpcap driver installed + app listening on top with raw sockets, which is in the <1% club of scenarios.

So @hexnomad found a pretty fun Windows vulnerability - CVE-2023-23415

Trigger remote code execution with fragmented IP packets wrapped in ICMP packets.

There may be some caveats on this one before the panic sets in, as you need an app listening on a raw socket and such. So no logos yet.

#CVE202323415