Denial of Service Attack Causes Windows NT Systems to Restart

ID: Q180963

The information in this article applies to:

Microsoft Windows NT Server version 4.0
Microsoft Windows NT Server version 4.0, Terminal Server Edition

SYMPTOMS

During the processing of a Server Message Block (SMB) logon request, memory corruption occurs causing one of the following errors:

STOP 0x0000000A

- OR -

STOP 0x00000050

The result is for the system to restart or stop responding (hang).

Note: The STOP errors will vary from case to case.

CAUSE

The size of data to follow is contained in the SMB logon request. When the size specified in the request does not match the size actually present, the corruption occurs.

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows NT 4.0 or Windows NT Server 4.0, Terminal Server Edition. For additional information, please see the following article in the Microsoft Knowledge Base:

Q152734 How to Obtain the Latest Windows NT 4.0 Service Pack

For your convenience, the English version of this post-SP3 hotfix has been posted to the following Internet location. However, Microsoft recommends that you install Windows NT 4.0 Service Pack 4 to correct this problem.

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/srv-fix

STATUS

Microsoft has confirmed this problem could result in some degree of security vulnerability in Windows NT version 4.0. This problem was first corrected in Windows NT 4.0 Service Pack 4.0 and Windows NT Server 4.0, Terminal Server Edition Service Pack 4.

Keywords : NT4SP4Fix ntstop kbbug4.00 kbfix4.00.sp4 NTSrv
Version : WinNT:4.0
Platform : winnt
Issue type : kbbug