Microsoft Terminal Services Can Be Crashed By Remote Users Conducting a TCP SYN Scan in Certain Situations
|
|
SecurityTracker Alert ID: 1004927 |
|
SecurityTracker URL: http://securitytracker.com/id/1004927
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Aug 1 2002
|
Impact:
Denial of service via network
|
Exploit Included: Yes
|
|
Description:
A denial of service vulnerability was reported in Microsoft Terminal Services. A remote user may be able to cause the Terminal Services to restart.
SecuriTeam reported that a remote user can cause Microsoft's Terminal Services to restart by scanning it using NMap' SYN scan method. According to the report, the scan must occur before the first client connects to it (i.e., just after the services have been started). The following demonstration exploit NMap SYN scan option is provided:
-sS -p "3389" xxx.xxx.xxx.xxx
SecuriTeam credits Pisut Khunchala with reporting this flaw.
|
Impact:
A remote user may be able to cause the terminal services to restart.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.microsoft.com/technet/security/ (Links to External Site)
|
Cause:
Exception handling error
|
Underlying OS:
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 1 Aug 2002 03:41:35 -0500
Subject: [NT] MS Terminal Services Vulnerable to SYN Scan
|
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -
MS Terminal Services Vulnerable to SYN Scan
------------------------------------------------------------------------
SUMMARY
A security vulnerability in Microsoft's Terminal Services allows remote
attackers to cause the service to restart by scanning it using NMap
utilizing its SYN scan method.
DETAILS
By scanning Microsoft's Terminal services before the first client connects
to it (just after the services have been started) using NMap's SYN scan
(with option -sS -p "3389" xxx.xxx.xxx.xxx), it is possible to cause the
Terminal Services to restart.
ADDITIONAL INFORMATION
The information has been provided by <mailto:pisut@netengtel.com> Pisut
Khunchala.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business
profits or special damages.
|
|
