The Windows 2000 Terminal Services component and Windows NT
Server 4.0, Terminal Server Edition, contain a memory leak in one of the
functions that processes incoming Remote Data Protocol (RDP) data via port
3389. Each time that an RDP packet that contains a specific type of
malformation is processed, the memory leak depletes overall server memory by a
small amount.
If an attacker were to send a sufficiently large
quantity of such data to an affected computer, the attacker could deplete the
computer's memory to the point where the response time would be slowed or the
computer's ability to respond would be stopped altogether. All system services
would be affected including but not limited to Terminal Services. Normal
operation could be restored by restarting the computer.
Windows 2000
To resolve this problem, obtain either the hotfix that is
referenced in this section or Windows 2000 Security Rollup Package 1 (SRP1).
For additional information about SRP1, click the article number
below to view the article in the Microsoft Knowledge Base:
311401Â
(http://kbalertz.com/Feedback.aspx?kbNumber=311401/EN-US/
)
Windows 2000 Security Rollup Package 1 (SRP1), January 2002
A
supported fix is now available from Microsoft, but it is only intended to
correct the problem that is described in this article. Apply it only to
computers that you determine are at risk of attack. Evaluate your computer's
physical accessibility, network and Internet connectivity, and other factors to
determine the degree of risk to your computer. See the associated
Microsoft
Security Bulletin
(http://www.microsoft.com/technet/security/bulletin/MS01-040.mspx)
to help determine the degree of risk. This fix may
receive additional testing. If your computer is sufficiently at risk, Microsoft
recommends that you apply this fix now. Otherwise, wait for the next Windows
2000 service pack that contains this fix.
To resolve this problem
immediately, download the fix by following the instructions later in this
article or contact Microsoft Product Support Services to obtain the fix. For a
complete list of Microsoft Product Support Services phone numbers and
information about support costs, visit the following Microsoft Web site:
NOTE: In special cases, charges that are ordinarily incurred for
support calls may be canceled if a Microsoft Support Professional determines
that a specific update will resolve your problem. The usual support costs will
apply to additional support questions and issues that do not qualify for the
specific update in question.
The following file is available for
download from the Microsoft Download Center:
Release Date: July 24,
2001
For additional information about how to download Microsoft
Support files, click the following article number to view the article in the
Microsoft Knowledge Base:
119591Â
(http://kbalertz.com/Feedback.aspx?kbNumber=119591/EN-US/
)
How to Obtain Microsoft Support Files from Online Services
Microsoft scanned this file for viruses. Microsoft used the most
current virus-detection software that was available on the date that the file
was posted. The file is stored on security-enhanced servers that help to
prevent any unauthorized changes to the file.
The English version of this fix should have the
following file attributes or later:
Date Time Version Size File name
----------------------------------------------------
6/27/2001 10:10a 5.0.2195.3356 19,928 Tdipx.sys
6/27/2001 10:10a 5.0.2195.3356 17,496 Tdnetb.sys
6/27/2001 10:10a 5.0.2195.3356 18,168 Tdtcp.sys
Windows NT Server 4.0, Terminal Server Edition
To resolve this problem, either obtain the hotfix referenced in
this section or the Windows NT Server 4.0, Terminal Server Edition, Security
Rollup Package (SRP).
For additional information about the SRP, click the article
number below to view the article in the Microsoft Knowledge Base:
317636Â
(http://kbalertz.com/Feedback.aspx?kbNumber=317636/EN-US/
)
Windows NT Server 4.0, Terminal Server Edition, Security Rollup Package
A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that this article describes. Apply it only to systems that you determine are at risk of attack. Evaluate the computer's physical accessibility, network and Internet connectivity, and other factors to determine the degree of risk to the computer. See the associated
Microsoft Security Bulletin
(http://www.microsoft.com/technet/security/bulletin/ms01-040.mspx)
to help determine the degree of risk. This hotfix may receive additional testing. If the computer is sufficiently at risk, we recommend that you apply this hotfix now.
To resolve this problem immediately, download the hotfix by following the instructions later in this article or contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:
Note In special cases, charges that are ordinarily incurred for support calls may be canceled, if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question. The following file is available for
download from the Microsoft Download Center:
Collapse this imageExpand this image
Release Date: July 24,
2001
For additional information about how to download Microsoft
Support files, click the following article number to view the article in the
Microsoft Knowledge Base:
119591Â
(http://kbalertz.com/Feedback.aspx?kbNumber=119591/EN-US/
)
How to Obtain Microsoft Support Files from Online Services
Microsoft scanned this file for viruses. Microsoft used the most
current virus-detection software that was available on the date that the file
was posted. The file is stored on security-enhanced servers that help to
prevent any unauthorized changes to the file.
The English version of this fix should have the
following file attributes or later:
Date Time Version Size File name
------------------------------------------------------
13-Jun-2001 17:47 4.0.1381.33478 18,520 Tdipx.sys
13-Jun-2001 17:47 4.0.1381.33478 17,048 Tdnetb.sys
13-Jun-2001 17:47 4.0.1381.33478 18,392 Tdtcp.sys
Windows 2000
Microsoft has confirmed that this problem may
cause a degree of security vulnerability in Windows 2000.
Windows NT Server 4.0, Terminal Server Edition
Microsoft has
confirmed that this problem may cause a degree of security vulnerability in
Windows NT Server 4.0, Terminal Server Edition.
For more information about this vulnerability, see the
following Microsoft Web site:
For
additional information about how to obtain a hotfix for Windows 2000 Datacenter
Server, click the article number below to view the article in the Microsoft
Knowledge Base:
265173Â
(http://kbalertz.com/Feedback.aspx?kbNumber=265173/EN-US/
)
The Datacenter Program and Windows 2000 Datacenter Server Product
For additional information about how to install multiple
hotfixes with only one reboot, click the article number below to view the
article in the Microsoft Knowledge Base:
296861Â
(http://kbalertz.com/Feedback.aspx?kbNumber=296861/EN-US/
)
Use QChain.exe to Install Multiple Hotfixes with One Reboot