2000018

	Jolt2
advICE :Intrusions : 2000018

FAQ

Oh my gosh, I'm being HACKED!!!

How do I report the hacker to my ISP?

I'm seeing lots of attacks, is this normal?

Summary
Denial of Service attempt
Details
The Jolt2 attack is designed to slow down your system by sending a flood of invalid traffic at it. While the system doesn't crash, this attacks causes the CPU utilitization to peg at 100%. The system will be unusable until the Jolt2 attack stops (which includes disconnecting your network cable).
All versions of Win9x, WinNT, and Win2k prior to June of 2000 were affected. There are patches available for these systems that will fix the problem. In addition, some Cisco equipment was affected.
Defense
If your system is being affected, you can simply disconnect the networking cable. The system is only affected while under attack.
Most firewalls will automatically filter out these packets.
Spoofing
Most instances of this attack are from spoofed IP addresses.

more information

Patch Available for "IP Fragment Reassembly" Vulnerability: Microsoft's document that describes the problem and lists a number of patches for their products.
spoofing: More about how to fake IP addresses.
advICE: Ping of Death: Jolt2 is simply a variant of the Ping-of-Death exploit.
MS Bulletin: MS00-029
CVE-2000-0305 Jolt2 IP Fragment Reassembly Windows DoS
BugtraqID: 1236

 
Version appeared: 2.2