Multiple Vendor "Out Of Band" Data Denial Of Service Vulnerability

Bugtraq ID:	2010
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	Yes
Published:	May 07 1997 12:00AM
Updated:	May 07 1997 12:00AM
Credit:	The exploit code credits _eci, no further discovery information could be determined.
Vulnerable:	SCO Open Server 5.0 Microsoft Windows NT 3.5.1 SP5 alpha Microsoft Windows NT 3.5.1 SP5 Microsoft Windows NT 3.5.1 SP4 Microsoft Windows NT 3.5.1 SP3 Microsoft Windows NT 3.5.1 SP2 Microsoft Windows NT 3.5.1 SP1 Microsoft Windows NT 3.5.1 Microsoft Windows NT 4.0 SP3 alpha Microsoft Windows NT 4.0 SP3 + Microsoft Windows NT Enterprise Server 4.0 SP3 + Microsoft Windows NT Enterprise Server 4.0 SP3 + Microsoft Windows NT Server 4.0 SP3 + Microsoft Windows NT Server 4.0 SP3 + Microsoft Windows NT Terminal Server 4.0 SP3 + Microsoft Windows NT Terminal Server 4.0 SP3 + Microsoft Windows NT Workstation 4.0 SP3 + Microsoft Windows NT Workstation 4.0 SP3 Microsoft Windows NT 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Workstation 4.0 + Microsoft Windows NT Workstation 4.0 Microsoft Windows 95 Microsoft Windows 3.11
Not Vulnerable:

Multiple Vendor "Out Of Band" Data Denial Of Service Vulnerability

Older versions of Microsoft Windows (95, Windows for Workgroups 3.11, Windows NT up to and including 4.0), as well as SCO Open Server 5.0, have a vulnerability relating to the way they handle TCP/IP "Out of Band" data.

According to Microsoft, "A sender specifies "Out of Band" data by setting the URGENT bit flag in the TCP header. The receiver uses the URGENT POINTER to determine where in the segment the urgent data ends. Windows NT bugchecks when the URGENT POINTER points to the end of the frame and no normal data follows. Windows NT expects normal data to follow. "

As a result of this assumption not being met, Windows gives a "blue screen of death" and stops responding.

Windows port 139 (NetBIOS) is most susceptible to this attack. although other services may suffer as well. Rebooting the affected machine is required to resume normal system functioning.

Multiple Vendor "Out Of Band" Data Denial Of Service Vulnerability

References:

• Stop 0A in Tcpip.sys When Receiving Out Of Band (OOB) Data (Microsoft)
  
• Update to Windows 95 TCP/IP to Address Out-of-Band Issue (Microsoft)