Microsoft Windows 2000 Telnet Username DoS Vulnerability

Bugtraq ID:	2838
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jun 07 2001 12:00AM
Updated:	Jun 07 2001 12:00AM
Credit:	Discovered and posted to Bugtraq by Michal Zalewski <[email protected]> on June 8, 2001. Published in a Microsoft Security Bulletin MS01-031.
Vulnerable:	Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server
Not Vulnerable:

Microsoft Windows 2000 Telnet Username DoS Vulnerability

Due to a flaw in the implementation of the telnet service, it is possible for a remote client to perform a denial of service attack against a host.

If approximately 4300 characters already exist in the input buffer and additional numerous specially chosen characters are provided, the service will stop responding.

Microsoft Windows 2000 Telnet Username DoS Vulnerability

The following bash script exploit has been provided by Michal Zalewski <[email protected]>:

• /data/vulnerabilities/exploits/mstelnettest.sh

Microsoft Windows 2000 Telnet Username DoS Vulnerability

Solution:
Microsoft has released a patch for Windows 2000 Advanced Server, Professional and Server which rectifies this issue. Microsoft has advised that Windows 2000 Datacenter Server patches are hardware specifice and should be obtained by the original equipment manufacturer.


Microsoft Windows 2000 Professional

• Microsoft Q299553
  http://download.microsoft.com/download/win2000platform/Patch/Q299553/N T5/EN-US/Q299553_W2K_SP3_x86_en.EXE

Microsoft Windows 2000 Server SP2

• Microsoft Q299553
  http://download.microsoft.com/download/win2000platform/Patch/Q299553/N T5/EN-US/Q299553_W2K_SP3_x86_en.EXE

Microsoft Windows 2000 Advanced Server SP1

• Microsoft Q299553
  http://download.microsoft.com/download/win2000platform/Patch/Q299553/N T5/EN-US/Q299553_W2K_SP3_x86_en.EXE

Microsoft Windows 2000 Server SP1

• Microsoft Q299553
  http://download.microsoft.com/download/win2000platform/Patch/Q299553/N T5/EN-US/Q299553_W2K_SP3_x86_en.EXE

Microsoft Windows 2000 Advanced Server SP2

• Microsoft Q299553
  http://download.microsoft.com/download/win2000platform/Patch/Q299553/N T5/EN-US/Q299553_W2K_SP3_x86_en.EXE

Microsoft Windows 2000 Professional SP2

• Microsoft Q299553
  http://download.microsoft.com/download/win2000platform/Patch/Q299553/N T5/EN-US/Q299553_W2K_SP3_x86_en.EXE

Microsoft Windows 2000 Advanced Server

• Microsoft Q299553
  http://download.microsoft.com/download/win2000platform/Patch/Q299553/N T5/EN-US/Q299553_W2K_SP3_x86_en.EXE

Microsoft Windows 2000 Professional SP1

• Microsoft Q299553
  http://download.microsoft.com/download/win2000platform/Patch/Q299553/N T5/EN-US/Q299553_W2K_SP3_x86_en.EXE

Microsoft Windows 2000 Server

• Microsoft Q299553
  http://download.microsoft.com/download/win2000platform/Patch/Q299553/N T5/EN-US/Q299553_W2K_SP3_x86_en.EXE

Microsoft Windows 2000 Telnet Username DoS Vulnerability

References:

• Microsoft Security Bulletin MS01-031 (Microsoft)