Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
55
Sequencing information
The Control Connection actually determines the rate and traffic congestion 
actions based on information from these GRE headers.
PPTP does not itself specify which algorithms or technologies to use for 
congestion-control and flow-control (though some are suggested), rather that is 
left open to the implementer to determine, but again, using the information from 
the GRE headers as the data to act against for adjustments.
Each PPTP Control Connection message  starts with an 8 octet fixed header 
with the following information contained within:
Total message length
Message type (either Control Message or Management Message)
“Magic Cookie” (a constant string of: “ 0x1A2B3C4D “
Any loss of synchronization is supposed to result in closing the connection 
immediately.