TCP.Out.Of.Range.Timestamp

Description

This indicates detection of a TCP packet with out-of-range Timestamps option.
The Timestamps option is used in PAWS (Protect Against Wrapped Sequences). It carries two four-byte timestamp fields. The Timestamp Value field (TSval) contains the current value of the timestamp which is the time of the TCP sending the option. The Timestamp Echo Reply field (TSecr) contains a timestamp value that was sent by the remote TCP in the TSval field of a Timestamps option.
The signature is disabled by default with its action set to "allow" due to the risk of false positives.

Affected Products

Multiple Vendors' TCP implementations are vulnerable.
Yamaha RTX2000
Yamaha RTX1500
Yamaha RTX1100
Yamaha RTX1000
Yamaha RTV700
Yamaha RT57i
Yamaha RT300i
Yamaha RT250i
Yamaha RT105
SCO Unixware 7.1.4
SCO Unixware 7.1.3
SCO Open Server 6.0
OpenBSD OpenBSD 3.6
OpenBSD OpenBSD 3.5
OpenBSD OpenBSD 3.4
OpenBSD OpenBSD 3.3
OpenBSD OpenBSD 3.2
OpenBSD OpenBSD 3.1
OpenBSD OpenBSD 3.0
Nortel Networks WLAN Access Point 7250.0
Nortel Networks WLAN Access Point 7220.0
Nortel Networks Universal Signaling Point Compact/Lite
Nortel Networks Universal Signaling Point 5200
Nortel Networks SRG 1.0
Nortel Networks Optical Metro 5200
Nortel Networks Optical Metro 5100
Nortel Networks Optical Metro 5000
Nortel Networks Ethernet Routing Switch 1648
Nortel Networks Ethernet Routing Switch 1624
Nortel Networks Ethernet Routing Switch 1612
Nortel Networks Contact Center
Nortel Networks Communications Server 1000
Nortel Networks CallPilot 703t
Nortel Networks CallPilot 702t
Nortel Networks CallPilot 201i
Nortel Networks CallPilot 200i
Nortel Networks BCM 400
Nortel Networks BCM 200
Nortel Networks BCM 1000
Microsoft Windows XP Tablet PC Edition SP1
Microsoft Windows XP Tablet PC Edition
Microsoft Windows XP Professional SP1
Microsoft Windows XP Professional
Microsoft Windows XP Media Center Edition SP1
Microsoft Windows XP Media Center Edition
Microsoft Windows XP Home SP1
Microsoft Windows XP Home
Microsoft Windows XP Embedded SP1
Microsoft Windows XP Embedded
Microsoft Windows XP 64-bit Edition Version 2003 SP1
Microsoft Windows XP 64-bit Edition Version 2003
Microsoft Windows XP 64-bit Edition SP1
Microsoft Windows XP 64-bit Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows Server 2003 Standard x64 Edition
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Enterprise Edition Itanium 0
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Datacenter Edition Itanium 0
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows 2000 Server SP4
Microsoft Windows 2000 Server SP3
Microsoft Windows 2000 Server SP2
Microsoft Windows 2000 Server SP1
Microsoft Windows 2000 Server
Microsoft Windows 2000 Professional SP4
Microsoft Windows 2000 Professional SP3
Microsoft Windows 2000 Professional SP2
Microsoft Windows 2000 Professional SP1
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Datacenter Server SP4
Microsoft Windows 2000 Datacenter Server SP3
Microsoft Windows 2000 Datacenter Server SP2
Microsoft Windows 2000 Datacenter Server SP1
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Advanced Server SP4
Microsoft Windows 2000 Advanced Server SP3
Microsoft Windows 2000 Advanced Server SP2
Microsoft Windows 2000 Advanced Server SP1
Microsoft Windows 2000 Advanced Server
IETF RFC 1323 : TCP Extensions for High Performance
Hitachi GS4000
Hitachi GR4000
Hitachi GR3000
Hitachi AlaxalA AX
FreeBSD FreeBSD 5.4 -RELENG
FreeBSD FreeBSD 5.4 -RELEASE
FreeBSD FreeBSD 5.4 -PRERELEASE
FreeBSD FreeBSD 5.3 -STABLE
FreeBSD FreeBSD 5.3 -RELENG
FreeBSD FreeBSD 5.3 -RELEASE
FreeBSD FreeBSD 5.3
FreeBSD FreeBSD 5.2.1 -RELEASE
FreeBSD FreeBSD 5.2 -RELENG
FreeBSD FreeBSD 5.2 -RELEASE
FreeBSD FreeBSD 5.2
FreeBSD FreeBSD 5.1 -RELENG
FreeBSD FreeBSD 5.1 -RELEASE/Alpha
FreeBSD FreeBSD 5.1 -RELEASE-p5
FreeBSD FreeBSD 5.1 -RELEASE
FreeBSD FreeBSD 5.1
FreeBSD FreeBSD 5.0 -RELENG
FreeBSD FreeBSD 5.0 -RELEASE-p14
FreeBSD FreeBSD 5.0 alpha
FreeBSD FreeBSD 5.0
FreeBSD FreeBSD 4.11 -STABLE
FreeBSD FreeBSD 4.11 -RELENG
FreeBSD FreeBSD 4.11 -RELEASE-p3
FreeBSD FreeBSD 4.10 -RELENG
FreeBSD FreeBSD 4.10 -RELEASE-p8
FreeBSD FreeBSD 4.10 -RELEASE
FreeBSD FreeBSD 4.10
FreeBSD FreeBSD 4.9 -RELENG
FreeBSD FreeBSD 4.9 -PRERELEASE
FreeBSD FreeBSD 4.9
FreeBSD FreeBSD 4.8 -RELENG
FreeBSD FreeBSD 4.8 -RELEASE-p7
FreeBSD FreeBSD 4.8 -PRERELEASE
FreeBSD FreeBSD 4.8
FreeBSD FreeBSD 4.7 -STABLE
FreeBSD FreeBSD 4.7 -RELENG
FreeBSD FreeBSD 4.7 -RELEASE-p17
FreeBSD FreeBSD 4.7 -RELEASE
FreeBSD FreeBSD 4.7
FreeBSD FreeBSD 4.6.2
FreeBSD FreeBSD 4.6 -STABLE
FreeBSD FreeBSD 4.6 -RELENG
FreeBSD FreeBSD 4.6 -RELEASE-p20
FreeBSD FreeBSD 4.6 -RELEASE
FreeBSD FreeBSD 4.6
FreeBSD FreeBSD 4.5 -STABLEpre2002-03-07
FreeBSD FreeBSD 4.5 -STABLE
FreeBSD FreeBSD 4.5 -RELENG
FreeBSD FreeBSD 4.5 -RELEASE-p32
FreeBSD FreeBSD 4.5 -RELEASE
FreeBSD FreeBSD 4.5
FreeBSD FreeBSD 4.4 -STABLE
FreeBSD FreeBSD 4.4 -RELENG
FreeBSD FreeBSD 4.4 -RELENG
FreeBSD FreeBSD 4.4 -RELEASE-p42
FreeBSD FreeBSD 4.4
FreeBSD FreeBSD 4.3 -STABLE
FreeBSD FreeBSD 4.3 -RELENG
FreeBSD FreeBSD 4.3 -RELEASE-p38
FreeBSD FreeBSD 4.3 -RELEASE
FreeBSD FreeBSD 4.3
FreeBSD FreeBSD 4.2 -STABLEpre122300
FreeBSD FreeBSD 4.2 -STABLEpre050201
FreeBSD FreeBSD 4.2 -STABLE
FreeBSD FreeBSD 4.2 -RELEASE
FreeBSD FreeBSD 4.2
FreeBSD FreeBSD 4.1.1 -STABLE
FreeBSD FreeBSD 4.1.1 -RELEASE
FreeBSD FreeBSD 4.1.1
FreeBSD FreeBSD 4.1
FreeBSD FreeBSD 4.0 .x
FreeBSD FreeBSD 4.0 -RELENG
FreeBSD FreeBSD 4.0 alpha
FreeBSD FreeBSD 4.0
FreeBSD FreeBSD 3.5.1 -STABLEpre2001-07-20
FreeBSD FreeBSD 3.5.1 -STABLE
FreeBSD FreeBSD 3.5.1 -RELEASE
FreeBSD FreeBSD 3.5.1
FreeBSD FreeBSD 3.5 x
FreeBSD FreeBSD 3.5 -STABLEpre122300
FreeBSD FreeBSD 3.5 -STABLEpre050201
FreeBSD FreeBSD 3.5 -STABLE
FreeBSD FreeBSD 3.5
FreeBSD FreeBSD 3.4 x
FreeBSD FreeBSD 3.4
FreeBSD FreeBSD 3.3 x
FreeBSD FreeBSD 3.3
FreeBSD FreeBSD 3.2 x
FreeBSD FreeBSD 3.2
FreeBSD FreeBSD 3.1 x
FreeBSD FreeBSD 3.1
FreeBSD FreeBSD 3.0 -RELENG
FreeBSD FreeBSD 3.0
FreeBSD FreeBSD 2.2.8
FreeBSD FreeBSD 2.2.6
FreeBSD FreeBSD 2.2.5
FreeBSD FreeBSD 2.2.4
FreeBSD FreeBSD 2.2.3
FreeBSD FreeBSD 2.2.2
FreeBSD FreeBSD 2.2 x
FreeBSD FreeBSD 2.2
FreeBSD FreeBSD 2.1.7 .1
FreeBSD FreeBSD 2.1.6 .1
FreeBSD FreeBSD 2.1.6
FreeBSD FreeBSD 2.1.5
FreeBSD FreeBSD 2.1 x
FreeBSD FreeBSD 2.1
FreeBSD FreeBSD 2.0.5
FreeBSD FreeBSD 2.0
FreeBSD FreeBSD 1.1.5 .1
FreeBSD FreeBSD 4.10-PRERELEASE
FreeBSD FreeBSD 3.x
FreeBSD FreeBSD 2.x
FreeBSD FreeBSD -current
F5 BigIP 9.0.5
F5 BigIP 9.0.4
F5 BigIP 9.0.3
F5 BigIP 9.0.2
F5 BigIP 9.0.1
F5 BigIP 9.0
F5 BigIP 4.6.2
F5 BigIP 4.6
F5 BigIP 4.5.12
F5 BigIP 4.5.11
F5 BigIP 4.5.10
F5 BigIP 4.5.9
F5 BigIP 4.5.6
F5 BigIP 4.5
F5 BigIP 4.4
F5 BigIP 4.3
F5 BigIP 4.2
F5 BigIP 4.0
Cisco Web Collaboration Option
Cisco Unity Server 4.0
Cisco Unity Server 3.3
Cisco Unity Server 3.2
Cisco Unity Server 3.1
Cisco Unity Server 3.0
Cisco Unity Server 2.46
Cisco Unity Server 2.4
Cisco Unity Server 2.3
Cisco Unity Server 2.2
Cisco Unity Server 2.1
Cisco Unity Server 2.0
Cisco Unity Server
Cisco Support Tools
Cisco SN5400 series storage routers
Cisco SN 5428 Storage Router SN5428-3.3.2-K9
Cisco SN 5428 Storage Router SN5428-3.3.1-K9
Cisco SN 5428 Storage Router SN5428-3.2.2-K9
Cisco SN 5428 Storage Router SN5428-3.2.1-K9
Cisco SN 5428 Storage Router SN5428-2.5.1-K9
Cisco SN 5428 Storage Router SN5428-2-3.3.2-K9
Cisco SN 5428 Storage Router SN5428-2-3.3.1-K9
Cisco SN 5420 Storage Router 1.1.3
Cisco SN 5420 Storage Router 1.1 (7)
Cisco SN 5420 Storage Router 1.1 (5)
Cisco SN 5420 Storage Router 1.1 (4)
Cisco SN 5420 Storage Router 1.1 (3)
Cisco SN 5420 Storage Router 1.1 (2)
Cisco Secure ACS Solution Engine 3.3.2
Cisco Secure ACS Solution Engine 3.3.1
Cisco Secure ACS Solution Engine 3.3
Cisco Secure ACS Solution Engine
Cisco Secure ACS for Windows Server 3.2
Cisco Secure ACS for Windows NT 3.1.1
Cisco Secure ACS for Windows NT 3.0.3
Cisco Secure ACS for Windows NT 3.0.1
Cisco Secure ACS for Windows NT 3.0
Cisco Secure ACS for Windows NT 2.42
Cisco Secure ACS for Windows NT 2.6.4
Cisco Secure ACS for Windows NT 2.6.3
Cisco Secure ACS for Windows NT 2.6.2
Cisco Secure ACS for Windows NT 2.6
Cisco Secure ACS for Windows NT 2.5
Cisco Secure ACS for Windows NT 2.4
Cisco Secure ACS for Windows NT 2.3
Cisco Secure ACS for Windows NT 2.1
Cisco Secure ACS for Unix 2.3.6 .1
Cisco Secure ACS for Unix 2.3.5 .1
Cisco Secure ACS for Unix 2.3
Cisco Secure ACS for Unix 2.0
Cisco Secure Access Control Server 3.3.2
Cisco Secure Access Control Server 3.3.1
Cisco Secure Access Control Server 3.3 (1)
Cisco Secure Access Control Server 3.3
Cisco Secure Access Control Server 3.2.2
Cisco Secure Access Control Server 3.2.1
Cisco Secure Access Control Server 3.2 (3)
Cisco Secure Access Control Server 3.2 (2)
Cisco Secure Access Control Server 3.2 (1.20)
Cisco Secure Access Control Server 3.2 (1)
Cisco Secure Access Control Server 3.2
Cisco Secure Access Control Server 3.1
Cisco Secure Access Control Server 3.0
Cisco Secure Access Control Server
Cisco Remote Monitoring Suite Option
Cisco Personal Assistant 1.4 (2)
Cisco Personal Assistant 1.4 (1)
Cisco Personal Assistant 1.3 (4)
Cisco Personal Assistant 1.3 (3)
Cisco Personal Assistant 1.3 (2)
Cisco Personal Assistant 1.3 (1)
Cisco Personal Assistant
Cisco MGX 8250 1.2.11
Cisco MGX 8250 1.2.10
Cisco MGX 8250 1.2.10
Cisco MGX 8230 1.2.11
Cisco MGX 8230 1.2.10
Cisco MGX 8230 1.2.10
Cisco MGX
Cisco MeetingPlace
Cisco IP Contact Center Express
Cisco IP Contact Center Enterprise
Cisco Interactive Voice Response
Cisco Intelligent Contact Manager 5.0
Cisco Intelligent Contact Manager
Cisco Emergency Responder 1.1
Cisco Emergency Responder
Cisco E-Mail Manager
Cisco CSS11800 Content Services Switch
Cisco CSS11506 Content Services Switch
Cisco CSS11503 Content Services Switch
Cisco CSS11501 Content Services Switch
Cisco CSS11500 Content Services Switch 7.30 (00.09)S
Cisco CSS11500 Content Services Switch 7.30 (00.08)S
Cisco CSS11500 Content Services Switch 7.20 (03.10)S
Cisco CSS11500 Content Services Switch 7.20 (03.09)S
Cisco CSS11500 Content Services Switch 7.10 (05.07)S
Cisco CSS11500 Content Services Switch
Cisco CSS11150 Content Services Switch
Cisco CSS11050 Content Services Switch
Cisco CSS11000 Content Services Switch
Cisco Conference Connection 1.2
Cisco Conference Connection 1.1 (1)
Cisco Conference Connection
Cisco CiscoWorks Windows/WUG 0
Cisco CiscoWorks Windows 0
Cisco CiscoWorks Windows
Cisco CiscoWorks VPN/Security Management Solution
Cisco CiscoWorks LMS 1.3
Cisco CiscoWorks Common Services 2.2
Cisco CiscoWorks Common Management Foundation 2.2
Cisco CiscoWorks Common Management Foundation 2.1
Cisco CiscoWorks Common Management Foundation 2.0
Cisco CiscoWorks CD1 5th Edition
Cisco CiscoWorks CD1 4th Edition
Cisco CiscoWorks CD1 3rd Edition
Cisco CiscoWorks CD1 2nd Edition
Cisco CiscoWorks CD1 1st Edition
Cisco CiscoWorks Access Control List Manager 1.6
Cisco CiscoWorks Access Control List Manager 1.5
Cisco CiscoWorks 1105 Wireless LAN Solution Engine
Cisco CiscoWorks 1105 Hosting Solution Engine
Cisco CiscoWorks
Cisco Call Manager 4.0
Cisco Call Manager 3.3 (3)
Cisco Call Manager 3.3
Cisco Call Manager 3.2
Cisco Call Manager 3.1 (3a)
Cisco Call Manager 3.1 (2)
Cisco Call Manager 3.1
Cisco Call Manager 3.0
Cisco Call Manager 2.0
Cisco Call Manager 1.0
Cisco Call Manager
Cisco AP350
Cisco AP1200
Cisco Agent Desktop
Blue Coat Systems SGOS
Blue Coat Systems CacheOS
Avaya Intuity Audix R5 0
Avaya Intuity AUDIX
Avaya Interactive Response 1.3
Avaya Interactive Response 1.2.1
Avaya Interactive Response
Avaya CVLAN
ALAXALA Networks AX7800S
ALAXALA Networks AX7800R
ALAXALA Networks AX5400S

Impact

Denial of Service

Recommended Actions

This indicates a detection of traffic that does not comply with the protocol standard. Monitor the traffic from that computer for any suspicious activity.

References