发布时间 :2000-03-04 00:00:00
修订时间 :2008-09-10 15:03:08

[原文]Microsoft Windows 9x operating systems allow an attacker to cause a denial of service via a pathname that includes file device names, aka the "DOS Device in Path Name" vulnerability.

[CNNVD]Microsoft Windows MS-DOS设备名远程拒绝服务攻击漏洞(MS00-017)(CNNVD-200003-010)

        Microsoft Windows是最流行的计算机操作系统。
        Microsoft Windows处理特殊的设备文件名时存在漏洞,远程或本地攻击者可能利用此漏洞对主机进行拒绝服务攻击,导致主机崩溃重启。

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: NONE [对系统的机密性无影响]
完整性影响: NONE [不会对系统完整性产生影响]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/o:microsoft:windows_95Microsoft Windows 95
cpe:/o:microsoft:windows_98::goldMicrosoft windows 98_gold
cpe:/o:microsoft:windows_98seMicrosoft windows 98_se

- OVAL (用于检测的技术细节)


- 官方数据库链接
(官方数据源) MITRE
(官方数据源) NVD
(官方数据源) CNNVD

- 其它链接及资源
(UNKNOWN)  BUGTRAQ  20000306 con\con is a old thing (anyway is cool)
(UNKNOWN)  MS  MS00-017
(UNKNOWN)  BID  1043

- 漏洞信息

Microsoft Windows MS-DOS设备名远程拒绝服务攻击漏洞(MS00-017)
中危 其他
2000-03-04 00:00:00 2012-11-28 00:00:00
        Microsoft Windows是最流行的计算机操作系统。
        Microsoft Windows处理特殊的设备文件名时存在漏洞,远程或本地攻击者可能利用此漏洞对主机进行拒绝服务攻击,导致主机崩溃重启。

- 公告与补丁

        MS00-017:Patch Available for "DOS Device in Path Name" Vulnerability

        - Windows 95:

        - Windows 98 and Windows 98 Second Edition:

- 漏洞信息 (19799)

Windows 2000/95/98/ME/NT 3.5.x/Enterprise Server 4.0/Terminal Server 4.0/Workstation 4.0 MS DOS Device Name DoS (EDBID:19799)
windows dos
2000-03-04 Verified
0 Anonymous
N/A [点击下载]
Windows 2000 Advanced Server/2000 Datacenter Server/2000 Professional/2000 Server/95/98/ME/NT 3.5.x/NT Enterprise Server 4.0/NT Terminal Server 4.0/NT Workstation 4.0 MS DOS Device Name DoS Vulnerability


Due to an inherent fault within the Microsoft Windows 9x/NT/2000 operating systems, local and remote users have the capability of crashing the system by simply requesting any permutation of a path and filename referring to a reserved DOS device name in the manner of device\device.

The following is an incomplete list of device names that have been known to render a system unstable: CON, NUL, AUX, PRN, CLOCK$, COMx, LPT1, and CONFIG$.

Exploiting this vulnerability can be done in a number of ways. Local users are able to crash the operating system by attempting to open a file of device\device, eg. within Microsoft Word, the Run dialog box, or at a command prompt. 
It is possible to remotely crash a Windows 9x/NT/2000 machine as well. This bug is exploitable remotely via any service that involves the remote user specifying paths on the target ie ftp or web services, netbios shares, etc. 

Malicious webmasters may exploit this vulnerability by creating a link that will invoke devices locally on the web user's machine.

In addition, many archiving programs will allow special devices to be called out of context. Some archivers have been known to drop device name files to an unspecified location on the disk. The majority of virus scanners are not affected by this issue.

The host must be restarted to regain normal functionality.

Some FTP servers running on a patched version of Windows 98 are still reported to be vulnerable.

It has been reported that aspects of this issue may still be exploitable via Internet Explorer on patched versions of Microsoft Windows operating systems. There are conflicting reports however, regarding what versions of Windows and Internet Explorer are affected. IE6, Windows ME, Windows 2000 SP4 and Windows XP SP1 have been reported to be affected, these reports however have not been confirmed.

Examples of how to remotely exploit this issue:

FTP: ftp> ls nul/nul
WWW: http ://target/con/con 

The same results can be achieved by visiting a website and viewing an HTML file with a local reference to device\device such as <img src="c:\con\con">.		

- 漏洞信息

Microsoft Windows MS DOS Device Name DoS
Remote / Network Access Denial of Service
Loss of Availability Patch / RCS
Exploit Public Vendor Verified, Third-party Verified

- 漏洞描述

- 时间线

2000-03-16 Unknow
Unknow 2000-03-16

- 解决方案

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

- 相关参考

- 漏洞作者

Unknown or Incomplete