----[ Win2k semi-remote DoS via IrDA Synopsis: There exists a "semi-remote" vulnerability against Windows machines via the IrDA port. The result of exploiting this vulnerability is the computer will crash, displaying a "Blue Screen of Death" (BSOD), shortly followed by rebooting. As IrDA ports are mostly found on laptops, these machines are more likely to be exploitable. Limited test data suggests this attack is successful against Windows 2000 Professional machines, but not successful against machines running Windows 98. Other OS versions have not been tested. Symptom: Machine crashes with BSOD. After a few seconds machine reboots. Trigger: Receiving an IrDA test frame. These can be generated by the irdaping utility under GNU/Linux Affected: Windows 2000 Professional Not affected: Windows 98 Work-around: Disable the IrDA port under the Device Manager. The truely paranoid can place Insulation/PVC tape over the port to prevent abuse. Recreate: 1. Startup laptops. My setup was: victim running Windows, protagonist running GNU/Linux. The Linux kernel must have IrDA support compiled in. 2. Under GNU/Linux, make sure irda-utils-0.9.10-9 is installed, other versions are untested, but will probably work too. 3. Do "irattach /dev/ttyS1 -s" or equivalent to activate the IrDA port. 4. Check the GNU/Linux side its working correctly by running the "irdadump" command. You should see repetitive output similar to: 07:28:17.790903 xid:cmd 4d274896 > ffffffff S=6 s=0 (14) 07:28:17.880849 xid:cmd 4d274896 > ffffffff S=6 s=1 (14) 07:28:17.970845 xid:cmd 4d274896 > ffffffff S=6 s=2 (14) 07:28:18.060858 xid:cmd 4d274896 > ffffffff S=6 s=3 (14) 07:28:18.150840 xid:cmd 4d274896 > ffffffff S=6 s=4 (14) 07:28:18.240861 xid:cmd 4d274896 > ffffffff S=6 s=5 (14) 07:28:18.330859 xid:cmd 4d274896 > ffffffff S=6 s=* rattusrattus hint=0400 [ Computer ] (28) 5. Place laptops so the infrared ports are aligned and within IrDA distance, irdadump should reflect new machine. The windows machine should also respond, usually by making a sound. 6. Run irdaping. The destination address ("0x4d274896" for above example) is required, but actual value doesn't matter. 7. Victim machine should display the BSOD at this point and reboot. Systems tested that were vulnerable: [] OEM laptop, Windows 2000 Professional service pack 2 v5.00.2195, National Semiconductor IrDA. Options: Infrared Trans. A: HP HSDL-1100/2100, Infrared Trans. B SIR Transceiver, Max Con. Rate: 4Mbps. Driver National Semiconductor 9/8/1999 v1.0.0.0 (signed MS 2000 Publisher) [] Toshiba Satellite Pro 4000, Windows 2000 Professional service pack 2 v5.00.2195, SMC IrCC IrDA. Options: Fast Infrared Port: Infrared Transceiver Type: auto, Min. Turn-Around Time: 1.0mS, Speed Limit: 4 Mbps, Driver: SMC 22/10/2000 v4.10.1999.5 (signed MS comp). [] Acer TravelMate 527TE P3-700MHz, Windows 2000 Professional Systems tested that were not vulnerable: [] Dell Inspiron 3200 D233XT TS30H, Windows 98 SE 4.10.1998 32Mb P2, IrDA driver (Microsoft 5-11-1998) [Thanks Jen!] [] IBM ThinkPad T21, Windows 98 SE 4.10.2222 A 128Mb P3, IrDA driver (Microsoft 4-23-1999) Discussion: After discovering the problem, a quick searched using Google revealed that Kevin Gottsman reported the same effect [1] back in December 2000 but only to "The Pasta Projects Linux-IrDA Forum" mailing list. The problem didn't appear on the vulnerabilities database at SecurityFocus [2], or on Microsoft's own website [3]. Microsoft were notified on July 4th 2001 and were able to quickly verify the problem. Their investigation suggests that the problem is driver specific (as Kevin suggested) and that it cannot cause remote code execution. A patch has been developed, see Microsoft bulletin MS01-046 [4] for details. From limited experimentation, disabling communication via the IrDA software does not prevent the vulnerability, the whole device must be disabled under the Device Manager to prevent the system from crashing. Acknowledgments: Thanks are due (in no particular order) to jools }B->, Tom How, Ritchie, Jen and Graham Woan for providing the cannon fodder: Windows isn't really my thing. [1] http://www.pasta.cs.uit.no/pipermail/linux-irda/2000-December/002144.html [2] http://www.securityfocus.com/ [3] http://www.microsoft.com/technet/security/ (following URL wraps) [4] http://www.microsoft.com/technet/treeview/default.asp?url=/technet/sec urity/bulletin/MS01-046.asp This vulnerability description is (c) 2001 Paul Millar (paulmat_private -- please remember the `m'). Reproduction, either partial or complete is permitted provided either this copyright notice is reproduced in its entirety, or provision is make to direct future readers to an instance of the complete copyright notice. This does not affect `fair usage'.
This archive was generated by hypermail 2b30 : Tue Aug 21 2001 - 13:46:29 PDT