Specifications

Nite Server FTPd Multiple DoS Vulnerabilities

Released May 19, 2000

Affects Nite Server 1.7, 1.6, 1.5

Reference http://www.securityfocus.com/bid/1230

Problem

- Multiple denials of service vulnerabilities exist in Nite Server FTP daemon.

- Requesting an unusually long string of characters in the user command will cause the daemon to

utilize all available memory, leaving the server to hang.

- If a remote user enters endless characters in the password field without ever terminating the

request, the daemon allocates all available memory and denies any new connections

- By logging on and making a request, which consists of malformed data and immediately logging

off, the ftp server will deny any new connections.

- When renaming files, if the new filename provided is too long, the server will stop accepting new

connections.

SAFER

- Updated version will be available shortly.

Microsoft Windows 9x / NT 4.0 / 2000 Fragmented IP Packets DoS Vulnerability

Released May 19, 2000

Affects Microsoft Windows 95, 98, NT4.0, 2000

Reference http://www.securityfocus.com/bid/1236

Problem

- Transmitting identical fragmented IP Packets to a Windows 9x, NT 4.0, NT Terminal Server, or

2000 host at a rate of approximately 150 packets per second will cause the target's CPU utilization

to reach 100%. CPU utilization will return to normal after the attack has ceased. In some cases,

this attack could produce a blue screen of death.

- The DoS initiated by this attack may not be related to IP fragmentation but rather to resource

exhaustion and a problem in filtering bad packets by Microsoft Windows.

SAFER

- Microsoft has released the patches that rectify the issue.

Axent NetProwler Malformed IP Packets DoS Vulnerability

Released May 18, 2000

Affects Axent NetProwler 3.0

Reference http://www.securityfocus.com/bid/1225

Problem

- Axent NetProwler 3.0 IDS is vulnerable to a malformed packet attack. It will crash if the Man-in-

the-Middle signature encounters a packet for which the following expression is true:

(IP_HEADER_LENGTH + TCP_HEADER_LENGTH) > IP_TOTAL_LENGTH

- In addition, NetProwler utilizes Microsoft JET engine 3.5 for storing incoming alert information.

SAFER

- In NetProwler 3.0, disable the Man-in-the-Middle signature for all monitored hosts.