IP Fragment Reassembly Vulnerability

If IP fragments having a particular malformation are sent to a Windows NT 4.0 or Windows 2000 computer in a continuous stream at a relatively low data rate, an implementation flaw will cause the computer to devote most or all of its CPU availability to processing the incoming fragments.

Issue

The affected systems contain a flaw in the code that performs IP fragment reassembly. If a continuous stream of fragmented IP datagrams with a particular malformation were sent to an affected machine, it could be made to devote most or all of its CPU availability to processing them. The data rate needed to completely deny service varies depending on the machine and network conditions, but in most cases even relatively moderate rates would suffice.

The vulnerability would not allow a malicious user to compromise data on the machine or usurp administrative control over it. Although it has been reported that the attack in some cases will cause an affected machine to crash, affected machines in all Microsoft testing returned to normal service shortly after the fragments stopped arriving. Machines protected by a proxy server or a firewall that drops fragmented packets would not be affected by this vulnerability. The machines most likely to be affected by this vulnerability would be machines located on the edge of a network such as web servers or proxy servers.

Affected Products

• Windows 95, 98, NT & 2000

Solution

Software patches are available from the following locations:

• Windows 95:
  http://download.microsoft.com/download/win95/update/8070/w95/EN-US/259728USA5.EXE
• Windows 98:
  http://download.microsoft.com/download/win98/update/8070/w98/EN-US/259728USA8.EXE
• Windows NT 4.0 Workstation, Server and Server, Enterprise Edition:
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=20829
• Windows NT 4.0 Server, Terminal Server Edition:
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=20830
• Windows 2000 Professional, Server and Advanced Server:
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=20827

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: May 19, 2000

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<