Q177539: Windows 95 Stops Responding Because of Land Attack

From: Aleph One (aleph1at_private)
Date: Thu Dec 04 1997 - 06:48:00 PST

  • Next message: Don Lewis: "Re: an detailed explaination why land attack works?"

    DOCUMENT:Q177539
    TITLE   :Windows 95 Stops Responding Because of Land Attack
    PRODUCT :Microsoft Windows 95
    PROD/VER:95
    OPER/SYS:WINDOWS
    KEYWORDS:kbbug kbenv kbpatch
    
    ---------------------------------------------------------------------
    The information in this article applies to:
    
     - Microsoft Windows 95
     - Microsoft Windows 95 OEM Service Release versions 1, 2, 2.1
    ---------------------------------------------------------------------
    
    SYMPTOMS
    ========
    
    After receiving spoofed connection request (SYN) packets over TCP/IP, a
    computer running Windows 95 may begin to operate slowly. After about one
    minute, Windows returns to normal operation.
    
    This problem may occur with TCP/IP on other operating systems as well.
    
    CAUSE
    =====
    
    This behavior occurs due to "Land Attack." Land Attack sends SYN packets
    with the same source and destination IP addresses and the same source and
    destination ports to a host computer. This makes it appear as if the host
    computer sent the packets to itself. Windows 95 operates more slowly while
    the host computer tries to respond to itself.
    
    RESOLUTION
    ==========
    
    Without WinSock 2.0 Update
    --------------------------
    
    This issue is resolved by the following updated file for Windows 95 and
    Windows 95 OEM Service Release 2 (OSR2) without the WinSock 2.0 update
    only:
    
       Vtcp.386 version 4.00.956 (dated 11/26/97) and later
    
    To install this update, follow these steps:
    
    1. Download the Vtcpup11.exe file from the Microsoft Software library to
       an empty folder on your hard disk..
    
    2. In My Computer or Windows Explorer, double-click the Vtcpup11.exe file
       you downloaded in step 1.
    
    3. Follow the instructions on the screen.
    
    The following file(s) are available for download from the Microsoft
    Software Library:
    
     ~ Vtcpup11.exe
    
    For more information about downloading files from the Microsoft Software
    Library, please see the following article in the Microsoft Knowledge Base:
    
       ARTICLE-ID: Q119591
       TITLE     : How to Obtain Microsoft Support Files from Online Services
    
    The following files are installed by Vtcpup11.exe:
    
       File name     Version    Date/Time        Size     Destination folder
       ----------------------------------------------------------------------
       Vtcp.386      4.00.956   11/26/97 9:56a   47,413   Windows\System
    
    With WinSock 2.0 Update
    -----------------------
    
    Microsoft has confirmed this to be a problem in the WinSock 2.0 update for
    Windows 95. We are researching this problem and will post new information
    here in the Microsoft Knowledge Base as it becomes available.
    
    STATUS
    ======
    
    Microsoft has confirmed this to be a problem in Microsoft Windows 95 and
    OEM Service Release 2 (OSR2). An update to address this problem is now
    available, but is not fully regression tested and should be applied only
    to computers experiencing this specific problem. Unless you are severely
    impacted by this specific problem, Microsoft does not recommend
    implementing this update at this time. Contact Microsoft Technical Support
    for more information.
    
    MORE INFORMATION
    ================
    
    For additional information about this issue as it applies to Microsoft
    Windows NT, please see the following article in the Microsoft Knowledge
    Base:
    
       ARTICLE-ID: Q165005
       TITLE     : Windows NT Slows Down Due to Land Attack
    
    For additional information about issues resolved by updates to this
    component, please see the following articles in the Microsoft
    Knowledge Base:
    
       ARTICLE-ID: Q170791
       TITLE     : Windows 95 TCP Clients Run Out of Ports
    
       ARTICLE-ID: Q168747
       TITLE     : Update to Windows 95 TCP/IP to Address Out-of-Band Issue
    
    Additional query words: 95
    
    ============================================================================
    
    THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
    PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
    ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
    OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
    EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
    ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
    CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
    MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
    POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
    OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
    SO THE FOREGOING LIMITATION MAY NOT APPLY.
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:34:21 PDT