Signature Detail

DNS: Microsoft Windows NAT Helper Remote Denial of Service

This signature detects attempts to exploit a known vulnerability against Microsoft Windows NAT Helper. A successful attack can result in a denial-of-service condition.

Extended Description

Microsoft Windows is prone to a remote denial-of-service vulnerability because the Server service fails to properly handle unexpected network traffic. Exploiting this issue may cause affected computers to crash, denying service to legitimate users. Reports indicate that this vulnerability can be used to disable the Windows firewall. To exploit this issue, an attacker must be able to send malformed network traffic from a network interface located in the LAN side of an affected computer.

Affected Products

• Microsoft windows_xp
• Microsoft windows_xp_home SP1
• Microsoft windows_xp_home SP2
• Microsoft windows_xp_home
• Microsoft windows_xp_media_center_edition SP1
• Microsoft windows_xp_media_center_edition SP2
• Microsoft windows_xp_media_center_edition
• Microsoft windows_xp_professional SP1
• Microsoft windows_xp_professional SP2
• Microsoft windows_xp_professional
• Microsoft windows_xp_tablet_pc_edition SP1
• Microsoft windows_xp_tablet_pc_edition SP2
• Microsoft windows_xp_tablet_pc_edition

References

• BugTraq: 20804
• CVE: CVE-2006-5614