Microsoft Windows IP Source Routing Vulnerability
BID:646
Info
Microsoft Windows IP Source Routing Vulnerability
| Bugtraq ID: | 646 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | Unknown |
| Published: | Sep 20 1999 12:00AM |
| Updated: | Sep 20 1999 12:00AM |
| Credit: | This vulnerability was discovered by Anthony Osborne <[email protected]> of the Network Associates security labs. |
| Vulnerable: |
Microsoft Windows NT Terminal Server 4.0 Microsoft Windows NT 4.0 SP5 Microsoft Windows NT 4.0 SP4 Microsoft Windows NT 4.0 SP3 Microsoft Windows NT 4.0 SP2 Microsoft Windows NT 4.0 SP1 Microsoft Windows NT 4.0 Microsoft Windows 98SE Microsoft Windows 98 b Microsoft Windows 98 a |
| Not Vulnerable: | |
Discussion
Microsoft Windows IP Source Routing Vulnerability
A vulnerability in the Windows 95/98 and NT TCP/IP stacks allows specially crafted IP packets to perform source routing functions, even when source routing has been specifically disabled (NT SP5 Registry Setting: (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableIPSourceRouting)
The vulnerability lies within the stack's inability to properly process source routed packets where the offset value is set greater than the specified route length. In this case, the data in the packet will get passed to the application layer of the host for further processing (instead of being dropped by the stack.) Should the attacker spoof the source address and, instead, use a source address of a known host on an internal network (assuming the Windows host is dual-homed), the datagram reply will be sent to the host on the internal network (accessible via the second NIC).
In addition to being susceptible to various tunneling attacks, the vulnerable host may be used to aid an attacker in locating other non-Windows hosts that have source routing enabled and/or perform port scans against other Windows hosts.
A vulnerability in the Windows 95/98 and NT TCP/IP stacks allows specially crafted IP packets to perform source routing functions, even when source routing has been specifically disabled (NT SP5 Registry Setting: (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableIPSourceRouting)
The vulnerability lies within the stack's inability to properly process source routed packets where the offset value is set greater than the specified route length. In this case, the data in the packet will get passed to the application layer of the host for further processing (instead of being dropped by the stack.) Should the attacker spoof the source address and, instead, use a source address of a known host on an internal network (assuming the Windows host is dual-homed), the datagram reply will be sent to the host on the internal network (accessible via the second NIC).
In addition to being susceptible to various tunneling attacks, the vulnerable host may be used to aid an attacker in locating other non-Windows hosts that have source routing enabled and/or perform port scans against other Windows hosts.
Exploit / POC
Microsoft Windows IP Source Routing Vulnerability
see discussion
see discussion
Solution / Fix
Microsoft Windows IP Source Routing Vulnerability
Solution:
Microsoft has released a post Service Pack 5 hotfix for Windows NT. It is available at:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/Hotfixes-PostSP5/Spoof-fix
A fix for Windows 95/98 will be released shortly.
Solution:
Microsoft has released a post Service Pack 5 hotfix for Windows NT. It is available at:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/Hotfixes-PostSP5/Spoof-fix
A fix for Windows 95/98 will be released shortly.
References
Microsoft Windows IP Source Routing Vulnerability
References:
References: