Older versions of Microsoft Windows Out of Band Data Vulnerability

vendor:

Windows

by:

SecurityFocus

7,5

CVSS

HIGH

Out of Band Data Vulnerability

N/A

CWE

Product Name: Windows

Affected Version From: Windows 95, Windows for Workgroups 3.11, Windows NT up to and including 4.0, SCO Open Server 5.0

Affected Version To: Windows 95, Windows for Workgroups 3.11, Windows NT up to and including 4.0, SCO Open Server 5.0

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2010

Older versions of Microsoft Windows Out of Band Data Vulnerability

Older versions of Microsoft Windows (95, Windows for Workgroups 3.11, Windows NT up to and including 4.0), as well as SCO Open Server 5.0, have a vulnerability relating to the way they handle TCP/IP "Out of Band" data. This vulnerability can be exploited by sending a malicious packet with the URGENT bit flag set in the TCP header, which will cause the affected system to crash and display a "blue screen of death". The attack is most effective against port 139 (NetBIOS), but other services may be affected as well.

Mitigation:

Microsoft has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/2010/info
 
Older versions of Microsoft Windows (95, Windows for Workgroups 3.11, Windows NT up to and including 4.0), as well as SCO Open Server 5.0, have a vulnerability relating to the way they handle TCP/IP "Out of Band" data.
 
According to Microsoft, "A sender specifies "Out of Band" data by setting the URGENT bit flag in the TCP header. The receiver uses the URGENT POINTER to determine where in the segment the urgent data ends. Windows NT bugchecks when the URGENT POINTER points to the end of the frame and no normal data follows. Windows NT expects normal data to follow. "
 
As a result of this assumption not being met, Windows gives a "blue screen of death" and stops responding.
 
Windows port 139 (NetBIOS) is most susceptible to this attack. although other services may suffer as well. Rebooting the affected machine is required to resume normal system functioning. 

perl -MIO::Socket -e 'IO::Socket::INET->new(PeerAddr=>"some.windoze.box:139")->send("bye",MSG_OOB)'