Global Village modem denial of service (ICMP_Modem_DoS)

About this signature or vulnerability

RealSecure Desktop, Proventia Network MFS, Proventia-G 1.1 and earlier, Proventia Network IDS, Proventia Server IPS for Linux technology, RealSecure Desktop Protector 3.6, Proventia Network IPS, Proventia Desktop, BlackICE Agent for Server, BlackICE PC Protection, BlackICE Server Protection, Proventia Server IPS for Microsoft Windows technology, RealSecure Server Sensor, RealSecure Network:

This signature detects an ICMP packet meant to reset some modems.


Default risk level

Medium risk vulnerability  Medium

Sensors that have this signature

RealSecure Desktop: baseline, Proventia Network MFS: 1.0, Proventia-G 1.1 and earlier: G Series, Proventia Network IDS: XPU 20.13, Proventia Server IPS for Linux technology: 1.0, RealSecure Desktop Protector 3.6: baseline, Proventia Network IPS: 2.0, Proventia Desktop: 8.0.614.1, BlackICE Agent for Server: 3.6eof, BlackICE PC Protection: 3.6cpa, BlackICE Server Protection: 3.6.cpa, Proventia Server IPS for Microsoft Windows technology: 1.0.914.0, RealSecure Server Sensor: XPU 20.16, RealSecure Network: XPU 20.13, RealSecure Network: XPU 5.12

Systems affected

Various vendors Any application

Type

Denial of Service

Vulnerability description

Global Village modem AT commands is vulnerable to a denial of service attack. An attacker can send an AT command to a remote computer that responds to commands, such as ctcp, ping, and icmp to cause the modem on the responding computer to execute the received commands. This attack can be performed on any computer with a Global Village modem.

How to remove this vulnerability

No remedy available as of June 6, 2009.

References

Macintouch Web site
Modem Guard Mode/Security Defect
http://www.macintouch.com/modemsecurity.html#workarounds

BUGTRAQ@netspace.org, Sun, 27 Sep 1998 13:52:33 -0400
1+2=3, +++ATH0=Old school DoS
http://www.attrition.org/security/denial/w/mod-ath.dos.html

ISS X-Force
Global Village modem denial of service
http://www.iss.net/security_center/static/3320.php

CVE
CVE-1999-1228
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-1228