Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
25
Summary of lab testing:
Verified that the attack worked, though not as quickly as some articles 
described.
CPU utilization increases up to +15% during attack but returns to normal 
when attack ends.
Server doesn’t crash instantly from the attack, but any attempts to run any 
programs, or shutdown the server (control panel, service, manager, command, 
etc.) will cause the system to blue screen with the message: 
“KMODE_EXCEPTION_NOT_HANDLED”
Surprisingly, if a client is already connected to server when the attack 
begins, it appears to “protect” the server from this attack. This is even true if the 
server has multiple VPN/RAS interfaces available to connect to, as long as one 
client is connected, it appears to defeat the attack.
The attack causes a DoS condition to the server even if the attack is only 
run for 5 seconds. Clients will not be able to complete three-way handshake 
necessary for connection after the attack has been initiated.
Connected client maintains VPN connection if attack starts after client is 
already connected, but cannot communicate with any services on the server’s 
side of the VPN (ping, file shares, network neighborhood, etc.), however all 
connections are available again as soon as the attack stops.