Windows 9x TCP Chorusing Vulnerability

Bugtraq ID:	225
Class:	Design Error
CVE:	CVE-1999-1201
Remote:	Yes
Local:	No
Published:	Feb 06 1999 12:00AM
Updated:	Jul 11 2009 12:16AM
Credit:	This vulnerability was posted to NTBugtraq by Dan Kaminsky <[email protected]>.
Vulnerable:	Microsoft Windows 98 Microsoft Windows 95
Not Vulnerable:	Microsoft Windows NT 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Workstation 4.0 + Microsoft Windows NT Workstation 4.0

Windows 9x TCP Chorusing Vulnerability

Windows 9x boxes can load multiple IP stacks to one NI card and IP address. When "pinged" from a Wintel host, these machines respond as normal. When "pinged" from a Linux client (ping or fping), these hosts will issue one ACK for each stack loaded on the NIC. (ie: if five stacks are loaded, one ACK and four duplicate ACKs will be sent). The multiple ACKs create collisions on the subnet which may affect network functionality of other hosts on the subnet.

With one offending host on the subnet, this TCP chorus may impact proper functioning of Samba hosts on the wire. With four TCP chorusers, an entire subnet may be rendered useless.

Windows 9x TCP Chorusing Vulnerability

see discussion

Windows 9x TCP Chorusing Vulnerability

Solution:
Unbind multiple IP stacks from Windows 9x hosts.

Windows 9x TCP Chorusing Vulnerability

References:

• TCP Chorusing in the Windows 9x TCP/IP Stack (Dan Kaminsky )