Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
From: Paul Millar (paulmastro.gla.ac.uk)
Date: Tue Aug 21 2001 - 15:38:01 CDT
----[ Win2k semi-remote DoS via IrDA
There exists a "semi-remote" vulnerability against Windows machines
via the IrDA port. The result of exploiting this vulnerability is
the computer will crash, displaying a "Blue Screen of Death" (BSOD),
shortly followed by rebooting. As IrDA ports are mostly found on
laptops, these machines are more likely to be exploitable. Limited
test data suggests this attack is successful against Windows 2000
Professional machines, but not successful against machines running
Windows 98. Other OS versions have not been tested.
Machine crashes with BSOD. After a few seconds machine reboots.
Receiving an IrDA test frame. These can be generated by the irdaping
utility under GNU/Linux
Windows 2000 Professional
Disable the IrDA port under the Device Manager. The truely paranoid
can place Insulation/PVC tape over the port to prevent abuse.
1. Startup laptops. My setup was: victim running Windows, protagonist
running GNU/Linux. The Linux kernel must have IrDA support
2. Under GNU/Linux, make sure irda-utils-0.9.10-9 is installed, other
versions are untested, but will probably work too.
3. Do "irattach /dev/ttyS1 -s" or equivalent to activate the IrDA
4. Check the GNU/Linux side its working correctly by running the
"irdadump" command. You should see repetitive output similar to:
07:28:17.790903 xid:cmd 4d274896 > ffffffff S=6 s=0 (14)
07:28:17.880849 xid:cmd 4d274896 > ffffffff S=6 s=1 (14)
07:28:17.970845 xid:cmd 4d274896 > ffffffff S=6 s=2 (14)
07:28:18.060858 xid:cmd 4d274896 > ffffffff S=6 s=3 (14)
07:28:18.150840 xid:cmd 4d274896 > ffffffff S=6 s=4 (14)
07:28:18.240861 xid:cmd 4d274896 > ffffffff S=6 s=5 (14)
07:28:18.330859 xid:cmd 4d274896 > ffffffff S=6 s=* rattusrattus hint=0400 [ Computer ] (28)
5. Place laptops so the infrared ports are aligned and within IrDA
distance, irdadump should reflect new machine. The windows
machine should also respond, usually by making a sound.
6. Run irdaping. The destination address ("0x4d274896"
for above example) is required, but actual value doesn't matter.
7. Victim machine should display the BSOD at this point and reboot.
Systems tested that were vulnerable:
 OEM laptop, Windows 2000 Professional service pack 2 v5.00.2195,
National Semiconductor IrDA.
Infrared Trans. A: HP HSDL-1100/2100,
Infrared Trans. B SIR Transceiver,
Max Con. Rate: 4Mbps.
Driver National Semiconductor 9/8/1999 v126.96.36.199 (signed MS 2000
 Toshiba Satellite Pro 4000, Windows 2000 Professional service pack 2
v5.00.2195, SMC IrCC IrDA.
Fast Infrared Port: Infrared
Transceiver Type: auto,
Min. Turn-Around Time: 1.0mS,
Speed Limit: 4 Mbps,
Driver: SMC 22/10/2000 v4.10.1999.5 (signed MS comp).
 Acer TravelMate 527TE P3-700MHz, Windows 2000 Professional
Systems tested that were not vulnerable:
 Dell Inspiron 3200 D233XT TS30H, Windows 98 SE 4.10.1998 32Mb P2,
IrDA driver (Microsoft 5-11-1998)
 IBM ThinkPad T21, Windows 98 SE 4.10.2222 A 128Mb P3, IrDA driver
After discovering the problem, a quick searched using Google
revealed that Kevin Gottsman reported the same effect  back in
December 2000 but only to "The Pasta Projects Linux-IrDA Forum"
mailing list. The problem didn't appear on the vulnerabilities
database at SecurityFocus , or on Microsoft's own website .
Microsoft were notified on July 4th 2001 and were able to quickly
verify the problem. Their investigation suggests that the problem
is driver specific (as Kevin suggested) and that it cannot cause
remote code execution.
A patch has been developed, see Microsoft bulletin MS01-046  for
From limited experimentation, disabling communication via the IrDA
software does not prevent the vulnerability, the whole device must
be disabled under the Device Manager to prevent the system from
Thanks are due (in no particular order) to jools }B->, Tom How,
Ritchie, Jen and Graham Woan for providing the cannon fodder:
Windows isn't really my thing.
(following URL wraps)
This vulnerability description is (c) 2001 Paul Millar
(paulmastro.gla.ac.uk -- please remember the `m'). Reproduction,
either partial or complete is permitted provided either this copyright
notice is reproduced in its entirety, or provision is make to direct
future readers to an instance of the complete copyright notice. This
does not affect `fair usage'.