A new way to crash some Windows-based operating systems has been discussed in security groups and mailing lists recently.

This is based on the fact that old DOS functions still remains in some of the 32 bits operating systems. The vulnerability exploits default devices like CON, COM etc.

In short, the vulnerability exposes the fact that these operating systems do not handle multiple references to the same built-in device correctly.

There are different ways to use this exploit.

Physical access

If someone gets physical access to a computer running Windows 95 or 98, she may cause that computer to crash by trying to start e.g. the non-existing file c:\nul\nul.

Web links

More dangerous is the fact that this technique may be used by malicious webmasters as well. 

Such a person can either create a link on her page which references such a device, or she may load the command into the browser by using the <img scr="device name"> tag.

You may test this by simply clicking on the link below, which is an implementation of the vulnerability.

This will crash your computer if you are running Windows 95 or Windows 98. Be sure that you do not have any open application with non-saved information.

Clicking this link here will crash a computer running Windows 95 or Windows 98.

E-mails

The most dangerous way to use this exploit however, is by embedding it in e-mails.

A user of HTML-enabled e-mail clients with preview mode enabled (like Microsoft's Outlook) will experience computer crash if he receives an e-mail from someone which has used a tag in the e-mail as described above. 

The link below to Frequently Asked Questions about this vulnerability describes how to disable preview mode in Outlook.

Other implications

It has been reported that the vulnerability may also be used to crash e.g. ftp-servers remotely, if the server is running on a computer with one of the vulnerable operating systems.

Microsoft has a patch available

Microsoft has released a patch which eliminates this vulnerability. We strongly advise users of Windows 95 and Windows 98 to install this patch.

More information about this vulnerability is available from these links:

• Microsoft's Security Bulletin MS00-017 (which includes links to the patches)
• Microsoft's Frequently Asked Questions regarding this vulnerability

Microsoft has also announced that the issue will be addressed as a Knowledge Base article with reference No Q256015. This was not available when this Security Information was written.

Users of Windows NT and Windows 2000 are not affected by this vulnerability.

Per Olav Førland