A vulnerability was found in Microsoft Windows NT 4.0 (Operating System). It has been rated as problematic. Affected by this issue is an unknown code of the component RPC Server. The manipulation with an unknown input leads to a denial of service vulnerability (Snork). Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. CVE summarizes:

The Windows NT RPC service allows remote attackers to conduct a denial of service using spoofed malformed RPC packets which generate an error message that is sent to the spoofed host, potentially setting up a loop, aka Snork.

The weakness was presented 09/29/1998 as MS98-014 as not defined security bulletin (Website). The advisory is shared for download at support.microsoft.com. This vulnerability is handled as CVE-1999-0969. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 05/08/2019). This vulnerability has a historic impact due to its background and reception.

Applying the patch MS98-014 is able to eliminate this problem. The bugfix is ready for download at technet.microsoft.com.

The vulnerability is also documented in the vulnerability database at X-Force (1372). support.microsoft.com is providing further details. See 14232 and 14231 for similar entries.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• NT 4.0

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion