Screaming Penguin

Yep, another "vulnerability" in Windows. This one affects Windows 9x and NT. This latest of the gaping security problems in Microsoft Software entails spoofing source routing and making it occur even if it has been explicitly and "ostensibly" disabled. You read that right, even though you may have a dual homed machine that you think routing is disabled on, you are wrong, with a simple exploit it is enabled and wide open. This is potentially a disaster for everyone with a dual homed Windows machine, get the patch. Microsoft Security Bulletin (MS99-038)--------------------------------------Patch Available for "Spoofed Route Pointer" VulnerabilityOriginally Posted: September 20, 1999Summary=======Microsoft has released a patch that eliminates a vulnerability in Microsoft(r) Windows(r) 95, 98 and Windows NT(r) 4.0 that could allow source routing to be performed, even if it has ostensibly been disabled. The patch also includes added functionality to provide additional control over source routing. Frequently asked questions regarding this vulnerability can be found at http://www.microsoft.com/security/bulletins/ms99-038faq.asp Issue=====Windows NT 4.0 Service Pack 5 introduced the ability to disable sourcerouting on a multi-homed Windows NT machine that acts as a router. However, even if source routing is disabled, it is possible to bypass it by including a specific type of incorrect information within the route pointer in the data packet. Windows 95 and 98 also provide this capability, and are affected by the same vulnerability. The patch restores correct operation to the anti-source routing feature. In addition, it provides additional functionality that enables source routing to be disabled on single-homed machines and on multi-homed machines that are not used as routers. Customers who are using multi-homed Windows 95, 98 or or Windows NT machines, and who wish to disable source routing should apply the patch to ensure proper operation of the anti-source routing features. In addition, customers who have non-routing machines in vulnerable locations (for example, single-homed machines outside of a firewall or multi-homed machines joining two subnets) may wish to install the patch in order to use the new functionality to disable source routing in these cases as well. Affected Software Versions==========================- Microsoft Windows 95- Microsoft Windows 98- Microsoft Windows 98 Second Edition- Microsoft Windows NT Workstation 4.0- Microsoft Windows NT Server 4.0- Microsoft Windows NT Server 4.0, Enterprise Edition- Microsoft Windows NT Server 4.0, Terminal Server EditionPatch Availability==================- Windows 95, 98 and Windows 98 Second Edition:To be released shortly- Windows NT 4.0 Workstation, Windows NT 4.0 Server and WindowsNT 4.0 Server, Enterprise Edition:ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/Hotfixes-PostSP5/Spoof-fix- Windows NT 4.0 Server, Terminal Server Edition: To be released shortly