DOCUMENT:Q238453 TITLE :Data in Route Pointer Field Can Bypass Source Routing Disable PRODUCT :Windows NT; Windows PROD/VER:4.0; 9x OPER/SYS:WINDOWS NT; Windows ------------------------------------------------------------------------------- The information in this article applies to: - Microsoft Windows NT Workstation version 4.0 - Microsoft Windows NT Server version 4.0 - Microsoft Windows NT Server, Enterprise Edition version 4.0 - Microsoft BackOffice Server version 4.0 - Microsoft BackOffice Small Business Server version 4.0 - Microsoft Windows NT Server version 4.0, Terminal Server Edition - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 Second Edition - Microsoft Windows 95 OEM Service Release versions 2, 2.1, 2.5 ------------------------------------------------------------------------------- SYMPTOMS ======== After you apply Windows NT 4.0 Service Pack 5 to your computer, you then attempt to disable TCP/IP source routing following the instructions in the Microsoft Knowledge Base article: Q217336 TCP/IP Source Routing Feature Cannot Be Disabled However, even if you disable source routing using the registry change referenced in the article above, it is possible to bypass this feature by including specific, incorrect information within the route pointer field in the data packet. RESOLUTION ========== WINDOWS NT 4.0 -------------- A supported fix that corrects this problem is now available from Microsoft, but it has not been fully regression tested and should be applied only to systems experiencing this specific problem. If you are not severely affected by this specific problem, Microsoft recommends that you wait for the next Windows NT 4.0 service pack that contains this fix. To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web: http://www.microsoft.com/support/supportnet/overview/overview.asp The English-language version of this fix should have the following file attributes or later: Date Time Size File name Platform -------------------------------------------------- 09/17/99 05:04p 150,832 tcpip.sys x86 09/17/99 05:03p 274,096 tcpip.sys Alpha This hotfix has been posted to the following Internet location as Ipsrfixi.exe and Ipsrfixa.exe: ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/ Hotfixes-PostSP5/Spoof-fix/ TERMINAL SERVER --------------- A supported fix that corrects this problem is now available from Microsoft, but it has not been fully regression tested and should be applied only to systems experiencing this specific problem. If you are not severely affected by this specific problem, Microsoft recommends that you wait for the next Windows NT 4.0 service pack that contains this fix. To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web: http://www.microsoft.com/support/supportnet/overview/overview.asp The English-language version of this fix should have the following file attributes or later: Date Time Size File name Platform -------------------------------------------------- 09/17/99 02:37p 147,376 Tcpip.sys x86 09/17/99 02:43p 268,560 Tcpip.sys Alpha NOTE: The patch listed above also includes added functionality and increased control over source routing so you can disable TCP/IP source routing on single-homed computers and on multihomed (more than one network interface) computers that are not used as routers. If you use a multihomed Windows NT-based computer to perform routing and you need to disable source routing, you should apply the patch to ensure proper operation of the anti-source routing features. If you have computers running Windows NT that are not configured as routers but are situated in vulnerable locations (for example, single-homed computers outside of a firewall or multihomed computers joining two subnets), you can install the patch to disable source routing in these cases as well. Windows 95 and Windows 98 ------------------------- A supported fix that corrects this problem is now available from Microsoft, but it has not been fully regression tested and should be applied only to systems experiencing this specific problem. To resolve this problem, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web: http://www.microsoft.com/support/supportnet/overview/overview.asp The English-language version of this fix should have the following file attributes or later: Date Time Version Size File name Platform ----------------------------------------------------------------- 09/23/99 03:47p 4.10.1659 75,885 Vip.386 Windows 95 (all) 09/23/99 02:57p 4.10.2000 75,777 Vip.386 Windows 98 Retail 09/23/99 02:39p 4.10.2224 80,409 Vip.386 Windows 98 Second Edition NOTE: Computers with any version of Windows 95 installed must have the Microsoft Dial Up Networking 1.3 Performance and Security Update installed before installing this update. You can find Windows 95 download information at: www.microsoft.com/windows95/downloads STATUS ====== Microsoft has confirmed this to be a problem in the Microsoft products listed at the beginning of this article. MORE INFORMATION ================ Under normal conditions, the sender of a TCP/IP data packet exercises no control over how a packet arrives at its destination. The sender simply sends the packet and relies on intermediate routers to dynamically select the best route, as determined by network traffic, router availability, and other factors. It is entirely possible that every packet going between two endpoints may take a different route. You can use source routing to specify the route that a packet must take to a destination. If the selected route is not available for any reason, the packet cannot be delivered. If the recipient replied to the packets, the response follows the same route. The route pointer is one of the fields in a TCP/IP data packet. It keeps track of the hops in the route list that the packet has already visited. A malicious user can bypass the anti-source routing controls in Windows NT 4.0 by manipulating this information and providing incorrect information to the router. Source routing is a legitimate activity in some cases. For example, you can use source routing to discover the TCP/IP addresses of routers within a network. However, a malicious user can use source routing to learn more about a network that he or she is targeting for attack. A data packet contains information about where the packet has traveled and which computers the packet has transited. A malicious user could send data into a network to collect information about the network's topology. If a user can perform source routing, he or she can probe the network more effectively by forcing packets into specific parts of the network. The original operating system functionality allows administrators to prevent source routing attacks through Windows NT-based computers that are used as routers. If you disable source routing, a multihomed computer that acts as a router does not forward any packets that request source routing. The additional functionality extends this protection to non-routing computers, whether they are single-homed or multihomed. Source routing attacks can be mounted against these computers as well, and you can use the new functionality to defeat such attacks. For related information on this problem, please visit the following Microsoft Web site: http://www.microsoft.com/security/bulletins/ms99-038.asp For additional security-related information about Microsoft products, please visit the following Microsoft Web site: http://www.microsoft.com/security/ For additional information about TCP/IP source routing, please refer to the following Request for Comments (RFC) documents: - 1256: ICMP Router Discovery Messages - 1812: Requirements for IP Version 4 Routers - 1322: A Unified Approach to Inter-Domain Routing - 1940: Source Demand Routing: Packet Format and Forwarding Specification For information about obtaining RFCs, please click the article number below to view the article in the Microsoft Knowledge Base: Q185262 How to Obtain Request for Comments Documents from the Internet Additional query words: ============================================================================ THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.