Executive brief
A vulnerability in Windows NT 4.0 allows a remote user to crash the server, leading to a Blue Screen of Death (BSoD). This occurs when the server processes specifically malformed network requests during file sharing operations. An attacker with even limited access to a network share can trigger this flaw, causing a complete service outage and requiring a manual reboot of the affected system.
Technical details
A denial of service vulnerability exists in Windows NT 4.0 Service Pack 2 due to improper handling of malformed SMB (Server Message Block) packets. The issue is triggered when a remote client, such as a Linux system using an incompatible version of the smbmount utility, sends malformed inputs during a directory listing request (ls) on a mounted share. This results in a kernel-level exception (IRQL_NOT_LESS_OR_EQUAL, STOP 0x0000000A) in ntoskrnl.exe, causing an immediate system crash. The attack requires the ability to reach the SMB service over the network and initiate a connection to a shared resource, even with read-only permissions.
Affected products
- Microsoft Windows NT 4.0 Service Pack 2
Timeline
- 1997-04-02: disclosed: Initial report on Bugtraq mailing list
- 1997-04-02: advisory: NVD publication date