J-Security Center

Title: Microsoft Windows 9x / Me IPX NMPI Packet DoS Vulnerability

Severity: MODERATE

Description:

If NWLink (which enables Microsoft Windows to interoperate with Novell stations) is enabled on a Windows 9x or ME system, it is possible to create broadcast storms which could severely impede upon network operations or cause certain targeted machines to fail.

IPX/SPX (Internetworked Packet Exchange/Sequenced Packet Exchange) is the protocol implemented by NWLink and periodically sends out broadcast messages across a network. NMPI (Netbios Name Management Port Interface) can be utilized as a NetBIOS replacement when implementing direct hosting with IPX.

Window 9x and ME do not properly handle NMPI packets that have the source network address and destination address containing the same value. Sending this type of packet would create a broadcast storm because every affected machine would respond to the broadcast address, that is, the entire network. One malformed NMPI packet could create a great deal of network congestion momentarily, however, sending several of them repeatedly could result in a prolonged network outage.

IPX is not installed by default on Windows 9x or ME systems with the exception of Windows 95 machines that had a plug 'n play network card present during the time of installation.

Affected Products:

  • Microsoft Windows 95
  • Microsoft Windows 98
  • Microsoft Windows 98SE
  • Microsoft Windows ME

References:

Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.