Network cards and dodgy Win 2003 drivers

Security Haphazard

By John Leyden, 16th June 2003

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Several network interface card device drivers that ship with Windows Server 2003 have been found to disclose information, according to an advisory by security firm Next Generation Security Software (NGS Software).

NGS Software compares the vulnerability to the 'Etherleak' frame padding issue announced by @Stake in January 2003 (PDF). That vulnerability concerned ICMP message padding whereas the latest warning covers a similar issue within a TCP stream.

Vulnerable drivers include: VIA Rhine II Compatible network card (integrated into some motherboards) and AMD PCNet family network cards (as used by several versions of VMWare).

Both drivers exhibit the same vulnerable behaviour, padding frames with arbitrary data, particularly during the FIN-ACK exchange when a connection is gracefully closed. Several bytes of potentially sensitive data (including POP3 passwords) has been observed appended to the data portion of Ethernet frames sent by these cards by security researchers at NGS Software.

This sounds bad but NGS Software rates the vulnerability as only low/medium risk because the vulnerability is difficult to exploit.

Microsoft blamed the flaw on third party drivers - not its OS. It is working with these third parties on a fix.

According to NGS Software some network drivers that are certified by Microsoft in its latest release of Windows are potentially vulnerable. So certification should not taken as a guarantee of protection.

End users should instead refer to a CERT-compiled list to determine their exposure to the vulnerability instead, NGS Software advises. ®