CVE-2020-5778
📋 TL;DR
An unauthenticated remote attacker can send a specially crafted type 8 message to Trading Technologies Messaging service on TCP port 10200, causing the ttmd.exe process to terminate. This affects Trading Technologies Messaging 7.1.28.3 installations with the default configuration. The vulnerability allows denial of service attacks against trading infrastructure.
💻 Affected Systems
- Trading Technologies Messaging
📦 What is this software?
Trading Technologies Messaging by Tradingtechnologies
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of trading operations due to service termination, potentially causing financial losses during market hours.
Likely Case
Service disruption requiring manual restart of ttmd.exe, causing temporary trading interruptions.
If Mitigated
Minimal impact if service is behind firewalls with restricted access and has automated restart capabilities.
🎯 Exploit Status
Exploit requires sending specially crafted type 8 message to port 10200. Tenable research provides technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.1.28.4 or later
Vendor Advisory: https://www.tradingtechnologies.com/
Restart Required: Yes
Instructions:
1. Contact Trading Technologies for updated version 2. Backup current configuration 3. Install patch 4. Restart ttmd.exe service 5. Verify service is running
🔧 Temporary Workarounds
Firewall Restriction
windowsBlock access to TCP port 10200 from untrusted networks
netsh advfirewall firewall add rule name="Block TT Port 10200" dir=in action=block protocol=TCP localport=10200
Service Monitoring and Auto-restart
windowsConfigure service to automatically restart if terminated
sc failure ttmd reset= 86400 actions= restart/5000
🧯 If You Can't Patch
- Implement network segmentation to restrict access to port 10200 only to trusted trading systems
- Deploy intrusion detection systems to monitor for exploitation attempts on port 10200
🔍 How to Verify
Check if Vulnerable:
Check if ttmd.exe version is 7.1.28.3 and listening on port 10200Check Version:
wmic process where name="ttmd.exe" get caption,versionVerify Fix Applied:
Verify ttmd.exe version is 7.1.28.4 or later and service remains running after sending test packets📡 Detection & Monitoring
Log Indicators:
- Unexpected termination of ttmd.exe process
- Error logs showing malformed type 8 messages
Network Indicators:
- Multiple connection attempts to port 10200 from single source
- Unusual traffic patterns to port 10200
SIEM Query:
source_port=10200 AND (event_type="process_termination" OR packet_size<100)