Denial of Service condition in Windows Terminal Services

Reported July 25, 2001, byMicrosoft.

VERSIONS AFFECTED

DESCRIPTION
Amemory leak exists in one of the functions used to process Transmission ControlProtocol (TCP) checksums on incoming Remote Data Protocol (RDP) information viaport 3389 of Terminal Services. Every time an RDP packet is sent to the serverusing a specially crafted malformed format, the server’s memory is depleted bya small amount. By repeatedly sending these packets a potential attacker caneffectively cause the server to stop responding completely, resulting in aDenial of Service (DoS).

VENDOR RESPONSE

Thevendor, Microsoft, has released securitybulletin MS01-040to address this vulnerability and recommends that users apply the followingpatches relevant to their system:

Windows NT 4.0 Terminal Server Edition patch: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=31615

Windows 2000 Server and Advanced Server patch: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=30195 

Windows 2000 Datacenter Server patches are hardwarespecific and available only through the Original Equipment Manufacturer (OEM).

CREDIT
Discovered by PeterGrundl.