Spoofed Route Pointer Vulnerability

A vulnerability exists in Microsoft® Windows® 95, 98 and Windows NT® 4.0 that could allow source routing to be performed, even if it has ostensibly been disabled.

Issue

Windows NT 4.0 Service Pack 5 introduced the ability to disable source routing on a multi-homed Windows NT machine that acts as a router. However, even if source routing is disabled, it is possible to bypass it by including a specific type of incorrect information within the route pointer in the data packet. Windows 95 and 98 also provide this capability, and are affected by the same vulnerability. The patch restores correct operation to the anti-source routing feature. In addition, it provides additional functionality that enables source routing to be disabled on single-homed machines and on multi-homed machines that are not used as routers.

Customers who are using multi-homed Windows or Windows NT machines to perform routing and who wish to disable source routing should apply the patch to ensure proper operation of the anti-source routing features. In addition, customers who have non-routing machines in vulnerable locations (for example, single-homed machines outside of a firewall or multi-homed machines joining two subnets) may wish to install the patch in order to use the new functionality to disable source routing in these cases as well.

Affected Products

• Windows 95, 98 and NT 4.0

Download

Patch: ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/Hotfixes-PostSP5/Spoof-fix

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: September 22, 1999

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<