Microsoft Windows MS DOS Device Name DoS Vulnerability
BID:1043
Info
Microsoft Windows MS DOS Device Name DoS Vulnerability
| Bugtraq ID: | 1043 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Mar 04 2000 12:00AM |
| Updated: | Mar 04 2000 12:00AM |
| Credit: | This issue has been publicly known for some time and has often been addressed in a case-by-case basis. See references for acknowledgements in specific cases. |
| Vulnerable: |
Microsoft Windows NT Workstation 4.0 SP6a Microsoft Windows NT Workstation 4.0 SP6 Microsoft Windows NT Workstation 4.0 SP5 Microsoft Windows NT Workstation 4.0 SP4 Microsoft Windows NT Workstation 4.0 SP3 Microsoft Windows NT Workstation 4.0 SP2 Microsoft Windows NT Workstation 4.0 SP1 Microsoft Windows NT Workstation 4.0 Microsoft Windows NT Terminal Server 4.0 SP6 Microsoft Windows NT Terminal Server 4.0 SP5 Microsoft Windows NT Terminal Server 4.0 SP4 Microsoft Windows NT Terminal Server 4.0 SP3 Microsoft Windows NT Terminal Server 4.0 SP2 Microsoft Windows NT Terminal Server 4.0 SP1 Microsoft Windows NT Terminal Server 4.0 Microsoft Windows NT Enterprise Server 4.0 SP6a Microsoft Windows NT Enterprise Server 4.0 SP6 Microsoft Windows NT Enterprise Server 4.0 SP5 Microsoft Windows NT Enterprise Server 4.0 SP4 Microsoft Windows NT Enterprise Server 4.0 SP3 Microsoft Windows NT Enterprise Server 4.0 SP2 Microsoft Windows NT Enterprise Server 4.0 SP1 Microsoft Windows NT Enterprise Server 4.0 Microsoft Windows NT 3.5.1 SP5 Microsoft Windows NT 3.5.1 SP4 Microsoft Windows NT 3.5.1 SP3 Microsoft Windows NT 3.5.1 SP2 Microsoft Windows NT 3.5.1 SP1 Microsoft Windows NT 3.5.1 Microsoft Windows NT 3.5 Microsoft Windows ME Microsoft Windows 98SE Microsoft Windows 98 j Microsoft Windows 98 b Microsoft Windows 98 Microsoft Windows 95 j Microsoft Windows 95 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server |
| Not Vulnerable: | |
Discussion
Microsoft Windows MS DOS Device Name DoS Vulnerability
Due to an inherent fault within the Microsoft Windows 9x/NT/2000 operating systems, local and remote users have the capability of crashing the system by simply requesting any permutation of a path and filename referring to a reserved DOS device name in the manner of device\device.
The following is an incomplete list of device names that have been known to render a system unstable: CON, NUL, AUX, PRN, CLOCK$, COMx, LPT1, and CONFIG$.
Exploiting this vulnerability can be done in a number of ways. Local users are able to crash the operating system by attempting to open a file of device\device, eg. within Microsoft Word, the Run dialog box, or at a command prompt.
It is possible to remotely crash a Windows 9x/NT/2000 machine as well. This bug is exploitable remotely via any service that involves the remote user specifying paths on the target ie ftp or web services, netbios shares, etc.
Malicious webmasters may exploit this vulnerability by creating a link that will invoke devices locally on the web user's machine.
In addition, many archiving programs will allow special devices to be called out of context. Some archivers have been known to drop device name files to an unspecified location on the disk. The majority of virus scanners are not affected by this issue.
The host must be restarted to regain normal functionality.
Some FTP servers running on a patched version of Windows 98 are still reported to be vulnerable.
It has been reported that aspects of this issue may still be exploitable via Internet Explorer on patched versions of Microsoft Windows operating systems. There are conflicting reports however, regarding what versions of Windows and Internet Explorer are affected. IE6, Windows ME, Windows 2000 SP4 and Windows XP SP1 have been reported to be affected, these reports however have not been confirmed.
Due to an inherent fault within the Microsoft Windows 9x/NT/2000 operating systems, local and remote users have the capability of crashing the system by simply requesting any permutation of a path and filename referring to a reserved DOS device name in the manner of device\device.
The following is an incomplete list of device names that have been known to render a system unstable: CON, NUL, AUX, PRN, CLOCK$, COMx, LPT1, and CONFIG$.
Exploiting this vulnerability can be done in a number of ways. Local users are able to crash the operating system by attempting to open a file of device\device, eg. within Microsoft Word, the Run dialog box, or at a command prompt.
It is possible to remotely crash a Windows 9x/NT/2000 machine as well. This bug is exploitable remotely via any service that involves the remote user specifying paths on the target ie ftp or web services, netbios shares, etc.
Malicious webmasters may exploit this vulnerability by creating a link that will invoke devices locally on the web user's machine.
In addition, many archiving programs will allow special devices to be called out of context. Some archivers have been known to drop device name files to an unspecified location on the disk. The majority of virus scanners are not affected by this issue.
The host must be restarted to regain normal functionality.
Some FTP servers running on a patched version of Windows 98 are still reported to be vulnerable.
It has been reported that aspects of this issue may still be exploitable via Internet Explorer on patched versions of Microsoft Windows operating systems. There are conflicting reports however, regarding what versions of Windows and Internet Explorer are affected. IE6, Windows ME, Windows 2000 SP4 and Windows XP SP1 have been reported to be affected, these reports however have not been confirmed.
Exploit / POC
Microsoft Windows MS DOS Device Name DoS Vulnerability
Examples of how to remotely exploit this issue:
FTP: ftp> ls nul/nul
WWW: http ://target/con/con
\\target\prn\prn
etc.
The same results can be achieved by visiting a website and viewing an HTML file with a local reference to device\device such as <img src="c:\con\con">.
Examples of how to remotely exploit this issue:
FTP: ftp> ls nul/nul
WWW: http ://target/con/con
\\target\prn\prn
etc.
The same results can be achieved by visiting a website and viewing an HTML file with a local reference to device\device such as <img src="c:\con\con">.
Solution / Fix
Microsoft Windows MS DOS Device Name DoS Vulnerability
Solution:
Microsoft has released the following patches which address this issue:
Microsoft Windows 98SE
Microsoft Windows 98
Microsoft Windows 95
Solution:
Microsoft has released the following patches which address this issue:
Microsoft Windows 98SE
-
Microsoft Q256015
http://download.microsoft.com/download/win98SE/Update/6467/W98/EN-US/2 56015USA8.EXE
Microsoft Windows 98
-
Microsoft Q256015
http://download.microsoft.com/download/win98SE/Update/6467/W98/EN-US/2 56015USA8.EXE
Microsoft Windows 95
References
Microsoft Windows MS DOS Device Name DoS Vulnerability
References:
References:
- Concon Bug Prevention Program (TechnoCraft Co.)
- Frequently Asked Questions: Microsoft Security Bulletin (MS00-017) (Microsoft)
- Securax-SA-01: Security Advisory (Securax)