Stop 0A in Tcpip.sys When Receiving Out Of Band (OOB) Data

• Microsoft Windows NT Workstation versions 3.51 and 4.0
• Microsoft Windows NT Server versions 3.51 and 4.0

SYMPTOMS

A Stop 0x0000000A occurs in Tcpip.sys when receiving Out of Band (OOB) data.

CAUSE

A sender specifies "Out of Band" data by setting the URGENT bit flag in the TCP header. The receiver uses the URGENT POINTER to determine where in the segment the urgent data ends. Windows NT bugchecks when the URGENT POINTER points to the end of the frame and no normal data follows. Windows NT expects normal data to follow.

RESOLUTION

Microsoft has updated Tcpip.sys to correct the problem. Instructions for installing it are available from Microsoft support channels, or directly from the Internet locations below.

NOTE: This hotfix was originally posted on May 12, 1997. A subsequent fix was completed on January 9, 1998 to address another nearly identical attack and this hotfix has replaced the original one. The original hotfix is included in Windows NT 4.0 Service Pack 3. The most recent hotfix is not, however it is available from the following Internet locations:

Windows NT 4.0 SP2

NOTE: Service pack 2 must be applied to Windows NT 4.0 prior to applying this fix.

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP2/oob-fix

Windows NT 4.0 SP3

NOTE: Service pack 3 must be applied to Windows NT 4.0 prior to applying this fix.

Oob-fix and Icmp-fix have been superseded by Teardrop2-fix. You can find the latest hotfix at the following Microsoft ftp site:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/teardrop2-fix

   01/09/98  08:16a               143,664 Tcpip.sys   (Intel)
   01/09/98  08:13a               263,536 Tcpip.sys   (Alpha)

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/archive/oob-fix

Windows NT 3.51

NOTE: Service pack 5 must be applied to Windows NT 3.51 prior to applying this fix.

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT351/
   hotfixes-postSP5/teardrop2-fix

   01/14/98  12:04p               123,824 Tcpip.sys   (Intel)
   01/14/98  12:00p               216,848 Tcpip.sys   (Alpha)

STATUS

Windows NT 4.0

Microsoft has confirmed this to be a problem in Windows NT version 4.0. A supported fix is now available, but has not been fully regression tested and should be applied only to systems experiencing this specific problem. Unless you are severely impacted by this specific problem, Microsoft recommends that you wait for the next Service Pack that contains this fix. Contact Microsoft Technical Support for more information.

Windows NT 3.51

Microsoft has confirmed this to be a problem in Windows NT version 3.51. A supported fix is now available, but is not fully regression tested and should be applied only to systems experiencing this specific problem. Unless you are severely impacted by this specific problem, Microsoft recommends that you wait for the next Service Pack that contains this fix. Contact Microsoft Product Support Services for more information.