From - Fri Sep 12 12:28:06 1997
Path: news.mitre.org!blanket.mitre.org!agate!newsgate.cuhk.edu.hk!logbridge.uoregon.edu!su-news-hub1.bbnplanet.com!cpk-news-hub1.bbnplanet.com!news.bbnplanet.com!Cabal.CESspool!bofh.vszbr.cz!lyra.csx.cam.ac.uk!server1.netnews.ja.net!warwick!wapping.ecs.soton.ac.uk!dps96r
From: dps96r@ecs.soton.ac.uk (Duncan Simpson)
Newsgroups: comp.os.ms-windows.nt.admin.security
Subject: Re: NT Crash after acces on special tcp port
Date: 5 Sep 1997 13:34:23 GMT
Organization: Electronics and Computer Science, University of Southampton
Lines: 34
Message-ID: <5up1ov$h3p@wapping.ecs.soton.ac.uk>
References: <01bcb93e$53e9e680$01000a86@compaq>
NNTP-Posting-Host: feynman.ecs.soton.ac.uk
X-Newsreader: NN version 6.5.0 #2 (NOV)

"Markus Palme" <markus.palme@t-online.de> writes:

>i have problems with tools like winnuk or winnce
>this tools access a special tcp port (i have no idea which one) and crash
>my
>nt installation
>microsoft has fixed this problem and there should be a patch.

Several attacks, all fixed by one of the 12 hot fixes.

ping of doom: NT crashes.
winuke: MSG_OOB to port 139. NT crashes.
ssping: Fragment reassemblu bug. NT crashes.
wins flooding: WINS exits. NT does not crash.
jizz, etc: NT cache gets false DNS information. NT DNS servers are
vulnerable too. Upgrading my (Linux) one to bind 8.1.1.

AFAIK there is no fix for

SYN flooding: Nobody is able to open a TCP connection to your
machine. Works w.o. any problems on all versions of NT AFAIK. Linux
2.0.30 with SYN cookies enabled is not vulnerable---someone is testing
this for us (without consulting us about it, this is hostile
activity).
Source routing: REally handy for faking the identity of my source
address and still getting all the packets! I just claim my (evil) box
is somewhere in the middle and NT sends all the replies via my box
(they actually stop there of course and orginated form there, but NT
can not notice). Linux and most other Unicies can be configured to
drop source routed packets. NT *should* be able to but can not.

...and more I do not have in my mind at present.

Duncan (-: