NSFOCUS Security Advisory(SA2000-04)
Topic£ºMicrosoft Win9x client driver type comparing vulnerability
Release Date£º August 20, 2000
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows 98 Second Edition
- Microsoft Windows NT
- Microsoft Windows 2000
NSFOCUS security team has found a security flaw in Microsoft Win9x
NETBIOS client. Exploitation of this vulnerability, a malicious
attacker can modify his host file share service and perform DoS attack
to a Win9x client that visits it.
When Win9x client accessing NETBIOS file shared services and comparing
the driver types, if the returned type from server is none of
below:"£¿£¿£¿£¿£¿"," A£º"," LPT1£º"," COMM"or"IPC"£¬it will lead to
the sixth result, which is fake cause there are only five of them. So,
win9x client will get a wrong driver pointer from conversion, transfer
the control to the wrong driver function address and finally crash.
Don't access the untrusted host's file share service.
Microsoft has been informed.
THE INFORMATION PROVIDED IS RELEASED BY NSFOCUS "AS IS" WITHOUT
WARRANTY OF ANY KIND. NSFOCUS DISCLAIMS ALL WARRANTIES, EITHER EXPRESS
OR IMPLIED, EXCEPT FOR THE WARRANTIES OF MERCHANTABILITY. IN NO
EVENTSHALL NSFOCUS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING
DIRECT, INDIRECT, INCIDENTAL,CONSEQUENTIAL, LOSS OF BUSINESS PROFITS
OR SPECIAL DAMAGES, EVEN IF NSFOCUS HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. DISTRIBUTION OR REPRODUTION OF THE
INFORMATION IS PROVIDED THAT THE ADVISORY IS NOT MODIFIED IN ANY WAY.
NSFOCUS Security Team <firstname.lastname@example.org>
NSFOCUS INFORMATION TECHNOLOGY CO.,LTD
©Copyright 2000 NSFOCUS Information Technology Co.,Ltd. All Rights