Check Point Advisories

Microsoft Windows TCP/IP Stack Reference Counter Overflow (MS11-083; CVE-2011-2013)

Check Point Reference:	CPAI-2011-560
Date Published:	6 Dec 2011
Severity:	Critical
Last Updated:	Saturday 01 January, 2011
Source:	Microsoft Security Bulletin MS11-083
Industry Reference:	CVE-2011-2013
Protection Provided by:
Who is Vulnerable?	Windows Vista Service Pack 2 Windows Vista x64 Edition Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for Itanium-based Systems Service Pack 2 Windows 7 for 32-bit Systems Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for x64-based Systems Windows 7 for x64-based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 R2 for Itanium-based Systems Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Vulnerability Description	A remote code execution vulnerability has been reported in Microsoft Windows TCP/IP stack.
Vulnerability Details	The vulnerability is caused due to an integer overflow in Windows TCP/IP stack while processing a continuous flow of specially crafted UDP packets. A remote attacker could trigger this issue by sending a continuous flow of specifically crafted UDP packets to a closed port on a target system. Successful exploitation could allow an attacker to run arbitrary code in kernel mode.