Archive of CERT general posting, CERT Summary CS-98.02

05/03/98, CERT Summary CS-98.02
From: CERT Advisory <>

Generated by MHonArc

CSIM Logo WelcomeCourses
Faculty, Student, Staff
Projects and reports
Conferences, workshop and seminars
Laboratories and reasearch facilities
Information related to CSIM
Information non-related to CSIM
Address, map, phone, etc.

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Subject: CERT Summary CS-98.02
From: CERT Advisory <>
Date: Wed, 4 Mar 1998 14:06:35 -0500
Organization: CERT(sm) Coordination Center - +1 412-268-7090


- ---------------------------------------------------------------------------
March 4, 1998

This special edition of the CERT Summary reports denial of service attacks
targeting a vulnerability in the Microsoft TCP/IP stack.

Past CERT Summaries are available from

- ---------------------------------------------------------------------------

Denial of service attacks targeting Windows 95/NT machines
- ----------------------------------------------------------

This special edition of the CERT Summary reports denial of service attacks
targeting a vulnerability in the Microsoft TCP/IP stack. We have received
reports from a number of sites and incident response teams indicating that a
large number of machines were affected.

The attacks involve sending a pair of malformed IP fragments which are
reassembled into an invalid UDP datagram. The invalid UDP datagram causes the
target machine to go into an unstable state. Once in an unstable state, the
target machine either halts or crashes. We have received reports that some
machines crashed with a blue screen while others rebooted.

Attack tools known by such names as NewTear, Bonk, and Boink have been
previously used to exploit this vulnerability against individual hosts;
however, in this instance, the attacker used a modified tool to automatically
attack a large number of hosts.

The solution to protect Windows 95 and NT machines from this attack is to
apply the appropriate Microsoft patch. The Microsoft patch, as well as more
information about the vulnerability, can be found in the January 1998
Microsoft Market Bulletin entitled, "New Teardrop-like TCP/IP Denial of
Service Program" available from:

Although the first instance of this attack, which started March 2, 1998
appears to be over, keep in mind that the tools to launch this attack are now
available and we expect to see more incidents of this type.

- ---------------------------------------------------------------------------
How to Contact the CERT Coordination Center


Phone    +1 412-268-7090 (24-hour hotline) 
                CERT personnel answer on business days
                8:30-5:00 p.m. EST (GMT-5)/EDT(GMT-4), 
                and are on call for emergencies during
                other hours.

Fax      +1 412-268-6989

Postal address
        CERT Coordination Center
        Software Engineering Institute
        Carnegie Mellon University
        Pittsburgh PA 15213-3890

To be added to our mailing list for CERT advisories and bulletins, send your
email address to
In the subject line, type
        SUBSCRIBE your-email-address

CERT advisories and bulletins are posted on the USENET news group

CERT publications, information about FIRST representatives, and other
security-related information are available for anonymous FTP from

If you wish to send sensitive incident or vulnerability information to CERT
staff by electronic mail, we strongly advise you to encrypt your message.
We can support a shared DES key or PGP. Contact the CERT staff for more

Location of CERT PGP key

- ---------------------------------------------------------------------------

Copyright 1998 Carnegie Mellon University. Conditions for use, disclaimers,
and sponsorship information can be found in and .
If you do not have FTP or web access, send mail to with
"copyright" in the subject line.
* CERT is registered in the U.S. Patent and Trademark Office.

Version: 2.6.2


Previous message sorted by date: CERT Summary CS-98.01
Next message sorted by date: CERT Summary CS-98.03
Previous message sorted by thread: CERT Summary CS-98.01
Next message by thread: CERT Summary CS-98.03
Main Index
Thread Index

CSIM home pageWMailAccount managementCSIM LibraryNetwork test toolsSearch CSIM directories
Contact us: Olivier Nicole CSIM    SET    AIT Last update: Feb 2000