Diversified Software Industries, Inc.

www.dsi-inc.net/dsi

Security Advisory



October 16, 2000



Denial of Service attack against computers running Microsoft NetMeeting



1. Description

2. Steps to reproduce (exploit)

3. Vendor status and solution

4. Disclaimer

5. Credits

6. About DSI



----------------------------------------

1. Description



NetMeeting is a free software product from Microsoft which allows realtime

audio/video conferencing among peer computers.  NetMeeting also contains a

component known as Remote Desktop Sharing (RDS).  RDS allows a technician to

take remote control of computers for troubleshooting, etc. RDS has some uses

which are similar to (but more limited than) Terminal Services, pcAnywhere,

etc.



The exploit below has been tested against the current version of NetMeeting

3.01 which ships with Windows 2000.  It has been tested on Windows 95, NT 4

Workstation and Server SP5/6, and Windows 2000 Workstation and Server SP1.

It has been tested against computers with either modem or ethernet

connections.

----------------------------------------

2. Steps to reproduce (exploit)



In this example, my.unix.box.com represents the attacker, and

hapless.victim.com represents the computer running NetMeeting in either

client or RDS mode.



Assuming you already have netcat installed on my.unix.box.com, enter the

following command line:



nc hapless.victim.com 1720 < /dev/zero



At this point, CPU usage on the victim machine becomes elevated, depending

on the speed of both machines, and the speed of the link between them.



Now, terminate the netcat command with ^C.  At this point, CPU on the victim

machine hits 100% and stays there.  If NetMeeting is running in client mode,

it can (eventually) be terminated via the Task Manager on Windows 2000 or

NT.  If RDS is active, it may be necessary to use another tool (such as

HandleEx) to terminate the RDS service; Task Manager may not have access to

this process.



If you are using RDS for remote server management, you may now need to make

a road trip to the remote computer to restore functionality.

----------------------------------------

3. Vendor status and solution



Microsoft has released a patch for Windows 2000.  Microsoft's bulletin is

available at http://www.microsoft.com/technet/security/bulletin/MS00-077.asp



NOTE: At this time, there are some issues with the NT 4.0 patch installer.

Microsoft is working to fix these issues, and an updated installer should be

available when complete.

----------------------------------------

4. Disclaimer



The information in this advisory is believed to be accurate.  No warranty is

given, express or implied.  Neither the author nor the publisher accepts any

liability whatsoever for any use of this information, nor do we condone the

use of this information for unethical purposes.

----------------------------------------

5. Credits



We would like to acknowledge Microsoft for their efforts to fix this

problem.  Also, we would like to acknowledge SecureXpert Labs for their

advisory SX-20000620-2 (see also MS00-050) which pointed out other Microsoft

services potentially vulnerable to /dev/zero attacks.

----------------------------------------

6. About DSI



Diversified Software Industries, Inc. is an Iowa City/Coralville, Iowa-based

company that develops and markets software for the graphical representation

of data in vehicles. In addition, DSI markets custom software development

and project management skills to firms in the over-the-road transportation

marketplace. These custom solutions provide back office and on-vehicle

wireless messaging management, as well as dispatching and resource tracking

systems.



You can find more information about DSI at www.dsi-inc.net/dsi