Vulnerability record · CVE-2005-0688 · published 5 March 2005
CVE-2005-0688: Windows Server 2003 and XP SP2 Land attack causes CPU exhaustion
Microsoft · Windows 2003 Server
A reoccurrence of the classic "Land" flaw affects Windows Server 2003 and XP SP2 when the Windows Firewall is disabled. A remote TCP packet with the SYN flag set and identical source and destination address and port causes CPU consumption, resulting in denial of service.
Description
Windows Server 2003 and XP SP2, with Windows Firewall turned off, allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the SYN flag set and the same destination and source address and port, aka a reoccurrence of the "Land" vulnerability (CVE-1999-0016).
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
medium priorityCVSS 2.0 rates this 5.0 (MEDIUM) with availability-only impact, and exploitation requires the Windows Firewall to be disabled.
What it is
A reoccurrence of the classic "Land" flaw affects Windows Server 2003 and XP SP2 when the Windows Firewall is disabled. A remote TCP packet with the SYN flag set and identical source and destination address and port causes CPU consumption, resulting in denial of service.
Impact
An attacker can exhaust CPU resources on the target host, degrading or halting its ability to serve legitimate traffic. No confidentiality or integrity impact is described; the effect is availability only.
Attack surface
Reachable over the network via TCP with no authentication required, as reflected by the AV:N/AC:L/Au:N vector. The flaw is only exposed when the Windows Firewall is turned off, so the built-in firewall acts as a mitigating precondition.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented. EPSS is 0.47439 (98.8th percentile), indicating high predicted likelihood, but the references carry no exploit tags and no public exploit status is stated.
What to do
- Apply the Microsoft security updates referenced in MS05-019 and MS06-064, which address this Land reoccurrence.
- Keep the Windows Firewall enabled on Windows Server 2003 and XP SP2 hosts; the flaw is described as exploitable only with the firewall turned off.
- Block or filter inbound TCP packets where source and destination address and port are identical at network boundaries.
- Retire or isolate unsupported Windows XP and Server 2003 systems that cannot be patched.
Detection
- Monitor for inbound TCP SYN packets whose source and destination IP address and port are identical.
- Alert on sustained CPU spikes on Windows Server 2003 or XP SP2 hosts that correlate with such packets.
- Audit Windows Firewall state on legacy hosts and alert when it is disabled.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2005-0688 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2005-0688), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
