Microsoft Windows 9x / Me IPX NMPI Packet DoS Vulnerability

If NWLink (which enables Microsoft Windows to interoperate with Novell stations) is enabled on a Windows 9x or ME system, it is possible to create broadcast storms which could severely impede upon network operations or cause certain targeted machines to fail.

IPX/SPX (Internetworked Packet Exchange/Sequenced Packet Exchange) is the protocol implemented by NWLink and periodically sends out broadcast messages across a network. NMPI (Netbios Name Management Port Interface) can be utilized as a NetBIOS replacement when implementing direct hosting with IPX.

Window 9x and ME do not properly handle NMPI packets that have the source network address and destination address containing the same value. Sending this type of packet would create a broadcast storm because every affected machine would respond to the broadcast address, that is, the entire network. One malformed NMPI packet could create a great deal of network congestion momentarily, however, sending several of them repeatedly could result in a prolonged network outage.

IPX is not installed by default on Windows 9x or ME systems with the exception of Windows 95 machines that had a plug 'n play network card present during the time of installation.


Privacy Statement
Copyright 2010, SecurityFocus