Several network interface card device drivers that ship with Windows Server 2003 have been found to disclose information, according to an advisory by security firm Next Generation Security Software (NGS Software).

NGS Software compares the vulnerability to the 'Etherleak' frame padding issue announced by @Stake in January 2003 (PDF). That vulnerability concerned ICMP message padding whereas the latest warning covers a similar issue within a TCP stream.

Both drivers exhibit the same vulnerable behaviour, padding frames with arbitrary data, particularly during the FIN-ACK exchange when a connection is gracefully closed. Several bytes of potentially sensitive data (including POP3 passwords) has been observed appended to the data portion of Ethernet frames sent by these cards by security researchers at NGS Software.

This sounds bad but NGS Software rates the vulnerability as only low/medium risk because the vulnerability is difficult to exploit.

Microsoft blamed the flaw on third party drivers - not its OS. It is working with these third parties on a fix.

According to NGS Software some network drivers that are certified by Microsoft in its latest release of Windows are potentially vulnerable. So certification should not taken as a guarantee of protection.

End users should instead refer to a CERT-compiled list to determine their exposure to the vulnerability instead, NGS Software advises. ®

Related Stories

First Win 2003 patch is really for IE
Critical Win2K flaw yields multiple attack vectors