Denial of Service Condition in Microsoft NNTP Service for Windows 2000/NT

Reported August 14, 2001, byMicrosoft.

VERSIONS AFFECTED

DESCRIPTION
Amemory leak condition exists in the way certain Windows OSs (see above) processnew postings when using the Network News Transfer Protocol (NNTP) service. If anattacker sends a large number of posts of a particular construction, those postscan deplete the server’s available memory and disrupt service. A user canreboot the server to resume normal service. Only servers that accept newpostings are vulnerable to this condition.

VENDOR RESPONSE

Thevendor, Microsoft, has released securitybulletin MS01-043to address this vulnerability and recommends that users apply whichever of thefollowing patches is relevant to their system:

WindowsNT 4.0 Server and Enterprise Server

Windows2000 Server and Advanced Server

Windows 2000 Datacenter Server patches arehardware-specific and available only through the OEM.

CREDIT
Discovered by AidenORawe.