BID:1082

NT / Windows 2000 TCP/IP Printing Service DoS Vulnerability

Info

NT / Windows 2000 TCP/IP Printing Service DoS Vulnerability

Bugtraq ID:	1082
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Mar 30 2000 12:00AM
Updated:	Mar 30 2000 12:00AM
Credit:	Posted to Bugtraq on March 30, 2000 by USSR Labs <[email protected]>.
Vulnerable:	Microsoft Windows NT Workstation 4.0 SP6a Microsoft Windows NT Workstation 4.0 SP6 Microsoft Windows NT Workstation 4.0 SP5 Microsoft Windows NT Workstation 4.0 SP4 Microsoft Windows NT Workstation 4.0 SP3 Microsoft Windows NT Workstation 4.0 SP2 Microsoft Windows NT Workstation 4.0 SP1 Microsoft Windows NT Workstation 4.0 Microsoft Windows NT Terminal Server 4.0 SP6 Microsoft Windows NT Terminal Server 4.0 SP5 Microsoft Windows NT Terminal Server 4.0 SP4 Microsoft Windows NT Terminal Server 4.0 SP3 Microsoft Windows NT Terminal Server 4.0 SP2 Microsoft Windows NT Terminal Server 4.0 SP1 Microsoft Windows NT Terminal Server 4.0 alpha Microsoft Windows NT Terminal Server 4.0 Microsoft Windows NT Server 4.0 SP6a + Avaya DefinityOne Media Servers + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 + Avaya S8100 Media Servers 0 Microsoft Windows NT Server 4.0 SP6 Microsoft Windows NT Server 4.0 SP5 Microsoft Windows NT Server 4.0 SP4 Microsoft Windows NT Server 4.0 SP3 Microsoft Windows NT Server 4.0 SP2 Microsoft Windows NT Server 4.0 SP1 Microsoft Windows NT Server 4.0 Microsoft Windows NT Enterprise Server 4.0 SP6a Microsoft Windows NT Enterprise Server 4.0 SP6 Microsoft Windows NT Enterprise Server 4.0 SP5 Microsoft Windows NT Enterprise Server 4.0 SP4 Microsoft Windows NT Enterprise Server 4.0 SP3 Microsoft Windows NT Enterprise Server 4.0 SP2 Microsoft Windows NT Enterprise Server 4.0 SP1 Microsoft Windows NT Enterprise Server 4.0 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional Microsoft Windows 2000 Advanced Server

Not Vulnerable:

Discussion

NT / Windows 2000 TCP/IP Printing Service DoS Vulnerability

The TCP/IP Printing Service (also known as Print Services for Unix in Windows 2000) is the mechanism used for print service integration with Unix environments.

It relies on port 515 for data transmittal. A malformed print request sent to this particular port can cause the service to cease functioning and can affect other services as well, including SimpTCP, DHCPServer, FTPSvc, LPDSvc, and BinlSvc. The service will require to be stopped and restarted in order to regain normal functionality.

The TCP/IP Printing Service is not installed by default on Windows NT or Windows 2000 and this exploit does not affect the printing services native to Windows.

Exploit / POC

NT / Windows 2000 TCP/IP Printing Service DoS Vulnerability

USSR Labs has released an exploit for this vulnerability.

Binary - windosprs.exe
Source Code - windosprs.zip

/data/vulnerabilities/exploits/windosprs.exe
/data/vulnerabilities/exploits/windosprs.zip

Solution / Fix

NT / Windows 2000 TCP/IP Printing Service DoS Vulnerability

Solution:
Microsoft has released patches which rectify this issue:

Microsoft Windows NT Enterprise Server 4.0