BID:1236

Multiple Vendor Fragmented IP Packets DoS Vulnerability

Info

Multiple Vendor Fragmented IP Packets DoS Vulnerability

Bugtraq ID:	1236
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	Yes
Published:	May 19 2000 12:00AM
Updated:	May 19 2000 12:00AM
Credit:	Discovered by Dmitri Netes of the BindView HackerShield Development Team and publicized in a Microsoft Security Bulletin (MS00-029) on May 19, 2000.
Vulnerable:	Microsoft Windows NT Workstation 4.0 SP6a Microsoft Windows NT Workstation 4.0 SP6 Microsoft Windows NT Workstation 4.0 SP5 Microsoft Windows NT Workstation 4.0 SP4 Microsoft Windows NT Workstation 4.0 SP3 Microsoft Windows NT Workstation 4.0 SP2 Microsoft Windows NT Workstation 4.0 SP1 Microsoft Windows NT Workstation 4.0 Microsoft Windows NT Terminal Server 4.0 SP6 Microsoft Windows NT Terminal Server 4.0 SP5 Microsoft Windows NT Terminal Server 4.0 SP4 Microsoft Windows NT Terminal Server 4.0 SP3 Microsoft Windows NT Terminal Server 4.0 SP2 Microsoft Windows NT Terminal Server 4.0 SP1 Microsoft Windows NT Terminal Server 4.0 Microsoft Windows NT Server 4.0 SP6a + Avaya DefinityOne Media Servers + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 + Avaya S8100 Media Servers 0 Microsoft Windows NT Server 4.0 SP6 Microsoft Windows NT Server 4.0 SP5 Microsoft Windows NT Server 4.0 SP4 Microsoft Windows NT Server 4.0 SP3 Microsoft Windows NT Server 4.0 SP2 Microsoft Windows NT Server 4.0 SP1 Microsoft Windows NT Server 4.0 Microsoft Windows NT Enterprise Server 4.0 SP6a Microsoft Windows NT Enterprise Server 4.0 SP6 Microsoft Windows NT Enterprise Server 4.0 SP5 Microsoft Windows NT Enterprise Server 4.0 SP4 Microsoft Windows NT Enterprise Server 4.0 SP3 Microsoft Windows NT Enterprise Server 4.0 SP2 Microsoft Windows NT Enterprise Server 4.0 SP1 Microsoft Windows NT Enterprise Server 4.0 Microsoft Windows 98 Microsoft Windows 95 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional Microsoft Windows 2000 Advanced Server Be BeOS 5.0

Not Vulnerable:

Discussion

Multiple Vendor Fragmented IP Packets DoS Vulnerability

Transmitting identical fragmented IP Packets to a Windows 9x, NT 4.0, NT Terminal Server, 2000 or Be/OS 5.0 host at a rate of approximately 150 packets per second will cause the target's CPU utilization to reach 100%. CPU utilization will return to normal after the attack has ceased. In some cases, this attack could produce a blue screen of death.

An analysis of the exploit was posted to BugTraq on May 26, 2000 by Mikael Olsson <[email protected]>. He concludes that the DoS initated by this attack may not be related to IP fragmentation but rather to resource exhaustion and a problem in filtering bad packets by Microsoft Windows.

See the message references by Mikael Olsson for a further interpretation of the mechanism of this attack.

Exploit / POC

Multiple Vendor Fragmented IP Packets DoS Vulnerability

Phonix Monkey <[email protected]> has released the following exploit:

/data/vulnerabilities/exploits/jolt2.c

Solution / Fix

Multiple Vendor Fragmented IP Packets DoS Vulnerability

Solution:
There are no known patches for Be/OS 5.0. Microsoft has released the following patches which rectify the issue. It should be noted that patches for Windows NT 4 on the Alpha platform are also available:

Microsoft Windows NT Enterprise Server 4.0