Executive brief
A vulnerability in the networking components of older Windows operating systems allows remote attackers to crash or reboot a computer. By sending specially crafted network traffic, an attacker can cause a 'Blue Screen of Death' or an unexpected system restart, leading to a total loss of availability for the affected machine. This issue primarily impacts the reliability of systems connected to the internet or local networks.
Technical details
The vulnerability is a variation of the 'Teardrop' attack, specifically known as 'Bonk'. It resides in the TCP/IP stack's handling of fragmented IP packets. An attacker sends a two-packet sequence of malformed UDP fragments (often targeting the DNS port to bypass firewalls) that overlap or contain invalid offset values. When the operating system attempts to reassemble these fragments, it triggers a kernel-level exception, resulting in a system crash (BSOD) or a spontaneous reboot. The issue affects Windows NT 3.51, NT 4.0, and Windows 95. Microsoft released the 'NewTear/Bonk/Boink' hotfix in early 1998 to address this flaw.
Affected products
- Microsoft Windows NT 4.0 Service Pack 3 and earlier
- Microsoft Windows NT 3.51 Service Pack 5 and earlier
- Microsoft Windows 95 All versions
Timeline
- 1998-01-01: patched: Microsoft released the NewTear/Bonk/Boink hotfix.
- 1998-02-13: advisory: NVD publication date.
- 1998-03-04: other: Microsoft technical update regarding widespread active exploitation.