Microsoft Windows Media Unicast Services DoS Vulnerability

Bugtraq ID:	1655
Class:	Race Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Sep 06 2000 12:00AM
Updated:	Sep 06 2000 12:00AM
Credit:	Discovered by Kit Knox and publicized in a Microsoft Security Bulletin (MS00-064) on September 6, 2000.
Vulnerable:	Microsoft Windows Media Services 4.1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Server SP4 + Microsoft Windows 2000 Server SP4 + Microsoft Windows 2000 Server SP3 + Microsoft Windows 2000 Server SP3 + Microsoft Windows 2000 Server SP2 + Microsoft Windows 2000 Server SP2 + Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server + Microsoft Windows NT 4.0 Microsoft Windows Media Services 4.0 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional + Microsoft Windows NT 4.0 + Microsoft Windows NT 4.0
Not Vulnerable:

Microsoft Windows Media Unicast Services DoS Vulnerability

If a certain malformed request is sent to a Windows Media Server, a synchronization error (or race condition) could be induced, thus opening up the possibility for further requests to halt all Unicast streaming media services. This particular vulnerability only affects Unicast media services, not Station, Program, or Monitor media services.

The Windows Media Unicast Service must be restarted from the Services Manager in order to regain normal functionality.

Microsoft Windows Media Unicast Services DoS Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Microsoft Windows Media Unicast Services DoS Vulnerability

Solution:
Microsoft has released patches which eliminates the vulnerability:


Microsoft Windows Media Services 4.0

• Microsoft WMSU27678 (4.0)
  Users of version of 4.0 must first upgrade to version 4.1 and then apply the patch.
  http://download.microsoft.com/download/winmediatech40/Update/27678/NT4 5/EN-US/WMSU27678.EXE

Microsoft Windows Media Services 4.1

• Microsoft WMSU27678 (4.1)
  http://download.microsoft.com/download/winmediatech40/Update/27678/NT4 5/EN-US/WMSU27678.EXE

Microsoft Windows Media Unicast Services DoS Vulnerability

References:

• Frequently Asked Questions: Microsoft Security Bulletin (MS00-064) (Microsoft)