CVE-2005-0356

Cisco Agent Desktop - Denial of Service via Spoofed TCP Timestamp Packet

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-0356. PoCs published by Daniel Hartmeier.

AI-analyzed exploit summary This exploit demonstrates a TCP timestamp validation flaw (CVE-2005-0356) in OpenBSD and FreeBSD, allowing an attacker to inject spoofed TCP segments with arbitrary timestamps, causing legitimate packets to be dropped by PAWS and stalling the connection.

Description

Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a spoofed packet with a large timer value, which causes the host to discard later packets because they appear to be too old.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Daniel Hartmeier · cdosmultiple

https://www.exploit-db.com/exploits/1008

View Code ZIP pw:eip

This exploit demonstrates a TCP timestamp validation flaw (CVE-2005-0356) in OpenBSD and FreeBSD, allowing an attacker to inject spoofed TCP segments with arbitrary timestamps, causing legitimate packets to be dropped by PAWS and stalling the connection.

Classification

Working Poc 95%

Attack Type

Dos

Complexity

Moderate

Reliability

Reliable

Target: OpenBSD and FreeBSD TCP/IP stack (pre-patch)

No auth needed

Prerequisites: Knowledge of source/destination IP and port of an active TCP connection · Ability to send spoofed TCP packets

MITRE ATT&CK