Data in Route Pointer Field Can Bypass Source Routing Disable

ID: Q238453

The information in this article applies to:
  • Microsoft Windows NT Workstation version 4.0
  • Microsoft Windows NT Server version 4.0
  • Microsoft Windows NT Server, Enterprise Edition version 4.0
  • Microsoft BackOffice Server version 4.0
  • Microsoft BackOffice Small Business Server version 4.0
  • Microsoft Windows NT Server version 4.0, Terminal Server Edition
  • Microsoft Windows 95
  • Microsoft Windows 98
  • Microsoft Windows 98 Second Edition
  • Microsoft Windows 95 OEM Service Release versions 2, 2.1, 2.5

SYMPTOMS

After you apply Windows NT 4.0 Service Pack 5 to your computer, you then attempt to disable TCP/IP source routing following the instructions in the Microsoft Knowledge Base article:

Q217336 TCP/IP Source Routing Feature Cannot Be Disabled
However, even if you disable source routing using the registry change referenced in the article above, it is possible to bypass this feature by including specific, incorrect information within the route pointer field in the data packet.


RESOLUTION

WINDOWS NT 4.0

To resolve this problem, obtain the latest service pack for Windows NT 4.0 or the individual software update. For information on obtaining the latest service pack, please go to:
For information on obtaining the individual software update, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web:
http://www.microsoft.com/support/supportnet/overview/overview.asp
This hotfix has been posted to the following Internet location as Ipsrfixi.exe and Ipsrfixa.exe:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/Hotfixes-PostSP5/Spoof-fix/

TERMINAL SERVER

To resolve this problem, obtain the latest service pack for Windows NT 4.0 or the individual software update. For information on obtaining the latest service pack, please go to:
For information on obtaining the individual software update, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web:
http://www.microsoft.com/support/supportnet/overview/overview.asp

NOTE: The patch listed above also includes added functionality and increased control over source routing so you can disable TCP/IP source routing on single-homed computers and on multihomed (more than one network interface) computers that are not used as routers.

If you use a multihomed Windows NT-based computer to perform routing and you need to disable source routing, you should apply the patch to ensure proper operation of the anti-source routing features. If you have computers running Windows NT that are not configured as routers but are situated in vulnerable locations (for example, single-homed computers outside of a firewall or multihomed computers joining two subnets), you can install the patch to disable source routing in these cases as well.

Windows 95 and Windows 98

A supported fix that corrects this problem is now available from Microsoft, but it has not been fully regression tested and should be applied only to systems experiencing this specific problem.

To resolve this problem, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web:
http://www.microsoft.com/support/supportnet/overview/overview.asp
The English-language version of this fix should have the following file attributes or later: 

   Date      Time    Version    Size    File name  Platform
   -----------------------------------------------------------------
   09/23/99  03:47p  4.10.1659  75,885  Vip.386    Windows 95 (all)
   09/23/99  02:57p  4.10.2000  75,777  Vip.386    Windows 98 Retail
   09/23/99  02:39p  4.10.2224  80,409  Vip.386    Windows 98 Second
                                                   Edition
NOTE: Computers with any version of Windows 95 installed must have the Microsoft Dial Up Networking 1.3 Performance and Security Update installed before installing this update. You can find Windows 95 download information at:
http://www.microsoft.com/windows95/downloads


STATUS

Microsoft has confirmed this to be a problem in the Microsoft products listed at the beginning of this article.

WINDOWS NT 4.0 AND TERMINAL SERVER

This problem was first corrected in Windows NT 4.0 Service Pack 6.


MORE INFORMATION

Under normal conditions, the sender of a TCP/IP data packet exercises no control over how a packet arrives at its destination. The sender simply sends the packet and relies on intermediate routers to dynamically select the best route, as determined by network traffic, router availability, and other factors. It is entirely possible that every packet going between two endpoints may take a different route.

You can use source routing to specify the route that a packet must take to a destination. If the selected route is not available for any reason, the packet cannot be delivered. If the recipient replied to the packets, the response follows the same route.

The route pointer is one of the fields in a TCP/IP data packet. It keeps track of the hops in the route list that the packet has already visited. A malicious user can bypass the anti-source routing controls in Windows NT 4.0 by manipulating this information and providing incorrect information to the router.

Source routing is a legitimate activity in some cases. For example, you can use source routing to discover the TCP/IP addresses of routers within a network. However, a malicious user can use source routing to learn more about a network that he or she is targeting for attack. A data packet contains information about where the packet has traveled and which computers the packet has transited. A malicious user could send data into a network to collect information about the network's topology. If a user can perform source routing, he or she can probe the network more effectively by forcing packets into specific parts of the network.

The original operating system functionality allows administrators to prevent source routing attacks through Windows NT-based computers that are used as routers. If you disable source routing, a multihomed computer that acts as a router does not forward any packets that request source routing. The additional functionality extends this protection to non-routing computers, whether they are single-homed or multihomed. Source routing attacks can be mounted against these computers as well, and you can use the new functionality to defeat such attacks.

For related information on this problem, please visit the following Microsoft Web site:

http://www.microsoft.com/security/bulletins/ms99-038.asp
For additional security-related information about Microsoft products, please visit the following Microsoft Web site:
http://www.microsoft.com/security/
For additional information about TCP/IP source routing, please refer to the following Request for Comments (RFC) documents:
  • 1256: ICMP Router Discovery Messages


  • 1812: Requirements for IP Version 4 Routers


  • 1322: A Unified Approach to Inter-Domain Routing


  • 1940: Source Demand Routing: Packet Format and Forwarding Specification


For information about obtaining RFCs, please click the article number below to view the article in the Microsoft Knowledge Base:
Q185262 How to Obtain Request for Comments Documents from the Internet

Additional query words:

Keywords : kbnetwork ntsp kbbug4.00 kbfix4.00 NT4SP6Fix
Version : WINDOWS:95; winnt:4.0
Platform : WINDOWS winnt
Issue type : kbbug


Last Reviewed: December 6, 1999
© 2000 Microsoft Corporation. All rights reserved. Terms of Use.