Microsoft Windows NT 4.0 RPC Server Snork denial of service

Summaryinfo

A vulnerability was found in Microsoft Windows NT 4.0 and classified as problematic. Impacted is an unknown function of the component RPC Server. Such manipulation leads to denial of service (Snork). This vulnerability is listed as CVE-1999-0969. There is no available exploit. This vulnerability is historically impactful due to its background and the reception it garnered. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in Microsoft Windows NT 4.0 (Operating System). It has been rated as problematic. Affected by this issue is an unknown code of the component RPC Server. The manipulation with an unknown input leads to a denial of service vulnerability (Snork). Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. CVE summarizes:

The Windows NT RPC service allows remote attackers to conduct a denial of service using spoofed malformed RPC packets which generate an error message that is sent to the spoofed host, potentially setting up a loop, aka Snork.

The weakness was presented 09/29/1998 as MS98-014 as not defined security bulletin (Website). The advisory is shared for download at support.microsoft.com. This vulnerability is handled as CVE-1999-0969. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 04/17/2026). This vulnerability has a historic impact due to its background and reception.

Applying the patch MS98-014 is able to eliminate this problem. The bugfix is ready for download at technet.microsoft.com.

The vulnerability is also documented in the databases at X-Force (1372) and Vulnerability Center (SBV-709†). support.microsoft.com is providing further details. See VDB-14232 and VDB-14231 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• NT 4.0

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion