[ advisories | exploits | discussions | news | conventions | security tools | texts & papers ]
 main menu
- feedback
- advertising
- privacy
- FightAIDS
- newsletter
- news
- read forum
- new topic
- search

- meetings list
- recent additions
- add your info
 top 100 sites
- visit top sites
- sign up now
- members

- add your url
- add domain
- search box
- link to us

- our projects
- free email
 m4d network
- security software
- secureroot
- m4d.com
Home : Advisories : Denial of Service attack against computers running Microsoft PPTP (NT 4.0)

Title: Denial of Service attack against computers running Microsoft PPTP (NT 4.0)
Released by: Diversified Software Industrie
Date: 22nd February 2001
Printable version: Click here
Diversified Software Industries, Inc.


Security Advisory

February 22, 2001

Denial of Service attack against computers running Microsoft PPTP (NT 4.0)

1. Description

2. Steps to reproduce (exploits)

3. Vendor status, solution, workarounds

4. Disclaimer

5. Credits

6. About DSI


1. Description

PPTP (Point-to-Point Tunneling Protocol) is a networking technology that is

used to create VPNs.  The protocol uses TCP (port 1723) and GRE to perform

its work.  PPTP is specified in RFC 2637 (see

http://www.ietf.org/rfc/rfc2637.txt )

This advisory presents three separate vulnerabilities.  All three

vulnerabilities affect Windows NT 4.0 Workstation and Server computers

configured to accept incoming PPTP connections.  The first vulnerability

involves malformed TCP packets; this vulnerability only affects certain

hardware, and only affects systems pre-SP6.  The second and third

vulnerabilities involve malformed GRE packets; these affect computers with

any Service Pack.

Note that Microsoft's original bulletin did not list NT 4.0 Workstation as

vulnerable.  However, if configured to accept incoming PPTP connections, NT

Workstation is vulnerable.  No versions of Windows 2000 are believed



2. Steps to reproduce (exploits)

Tools needed:

Unix box (e.g., Linux, *BSD)

netcat ( http://www.l0pht.com/~weld/netcat/ or

http://www.securityfocus.com/tools/137 )

apsend ( http://www.elxsi.de/ or http://www.securityfocus.com/tools/976 )

ipsend ( http://coombs.anu.edu.au/%7Eavalon/ or

http://www.securityfocus.com/tools/129 )

Vulnerability 1:  TCP Port 1723

This vulnerability only applies to machines prior to SP6.  Not all machines

are affected; it appears there may be some BIOS or other issue at work here.

To reproduce, enter the following on the Unix box:

nc  1723 < /dev/zero

If vulnerable, the target host will blue screen in a few seconds with an

error such as:

STOP 0x0A (0x0, 0x2, 0x0, 0x0)


Again, this vulnerability is machine-dependant; a list of tested hardware

and results can be found in the online version of this advisory at


Vulnerability 2:  GRE

This vulnerability applies to all service packs.  To reproduce, on the

target machine, open task manager and select the performance tab.  Also,

open a DOS window (Start: Run: cmd).  On the Unix box:

apsend -d  --protocol 47 -m 0 -q

On the target host, you will see the numbers for kernel memory slowly rise

in task manager.  Eventually, these numbers will stop increasing; at this

point, CPU may hit 100% for some period of time.  Now try issuing a command

such as DIR at the command prompt; you'll see a message indicating the OS

isn't able to complete the command.  Also, you may find the following in

your System event log:

Event ID: 2000 "The server's call to a system service failed unexpectedly."


Event ID: 2019 "The server was unable to allocate from the system nonpaged

pool because the pool was empty."

Eventually, the target host may reboot/blue screen, or it may simply remain

in an unusable state.  As noted by Microsoft in their description of the

issue, a large number of packets is required.  For a server with 64 MB RAM

installed, something on the order of 350,000 to 400,000 packets is needed.

Note that the effect is cumulative; e.g., an attacker could send 200,000

packets at 10 A.M. and 200,000 at 2 P.M.

Vulnerability 3:  GRE

This vulnerability also applies to all service packs.  To reproduce, on the

Unix box:



        ipsend -i  -P gre  > /dev/null

goto foo

The target host will blue screen quickly.  Approximately 50 packets are



3. Vendor status, solution, workaround

Microsoft has released a patch on February 13, 2000. Microsoft's bulletin is

available at http://www.microsoft.com/technet/security/bulletin/MS01-009.asp

As a workaround, it is possible to filter GRE by source address at your

perimeter.  However, since GRE is a connectionless protocol, source address

spoofing is trivial.  Thus, if an attacker can guess what source addresses

are allowed, filtering may not be effective.


4. Disclaimer

The information in this advisory is believed to be accurate.  No warranty is

given, express or implied.  Neither the author nor the publisher accepts any

liability whatsoever for any use of this information, nor do we condone the

use of this information for unethical purposes.


5. Credits

Microsoft, for their efforts to fix this problem

Chris Manjoine of the University of Iowa, for his help testing the exploits

Hobbit, Anarchy, and Darren Reed, for their useful tools


6. About DSI

Diversified Software Industries, Inc. is an Iowa City/Coralville, Iowa-based

company that develops and markets software for the graphical representation

of data in vehicles. In addition, DSI markets custom software development

and project management skills to firms in the over-the-road transportation

marketplace. These custom solutions provide back office and on-vehicle

wireless messaging management, as well as dispatching and resource tracking


You can find more information about DSI at http://www.dsi-inc.net/dsi

(C) 1999-2000 All rights reserved.