Microsoft Win9x Challenge Replay Vulnerability

Bugtraq ID:	143
Class:	Design Error
CVE:
Remote:	Unknown
Local:	Unknown
Published:	Jan 05 1999 12:00AM
Updated:	Jan 05 1999 12:00AM
Credit:
Vulnerable:	Microsoft Windows 98 Microsoft Windows 95
Not Vulnerable:	Microsoft Windows NT 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Workstation 4.0 + Microsoft Windows NT Workstation 4.0 Microsoft Windows 2000 Professional Microsoft Windows 3.11 Microsoft Windows 3.11 Microsoft Windows 3.1

Microsoft Win9x Challenge Replay Vulnerability

The L0pht identified a weakness in Microsoft's Win9x authentication mechanism whereby the Win9x server issues the same cryptographic challenge for up to fifteen minutes. In a typical NT to Win9x authentication process, the Win9x server issues a challenge that is used by the NT server to encrypt the LanMan hash. The challenge-encrypted LanMan hash, along with the proper username, will grant an authorized user access to given resources on the Win9x server.

Should an unauthorized user "sniff" the challenge-response sequence of a valid NT-Win9x login, he or she may replay this string from their own host to gain access to the Win9x server without knowledge of the clear-text password.

Microsoft Win9x Challenge Replay Vulnerability

A modified SMB client may be compiled that will allow the sniffed challenge-response and username to be replayed against the Win9x server.

Microsoft Win9x Challenge Replay Vulnerability

Solution:
There are no known patches to Win9x to prevent the reuse of challenge tokens.

A registry key modification is available for Windows NT. Setting LMCompatibilityLevel to '2' or '3' will prevent an NT host from connecting to a "downlevel" server (ie Win9x)

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA
Value: LMCompatibilityLevel
Value Type: REG_DWORD - Number
Valid Range: 0-5
Default: 0
Description: This parameter specifies the type of authentication to be
used.

Level 0 - Send LM response and NTLM response; never use NTLMv2 session
security
Level 1 - Use NTLMv2 session security if negotiated
Level 2 - Send NTLM response only
Level 3 - Send NTLMv2 response only
Level 4 - DC refuses LM responses
Level 5 - DC refuses LM and NTLM responses (accepts only NTLMv2)

Microsoft Win9x Challenge Replay Vulnerability

References: