DOCUMENT:Q243835 TITLE :How to Prevent Predictable TCP/IP Initial Sequence Numbers PRODUCT :Windows NT PROD/VER:4.0 OPER/SYS:WINDOWS NT KEYWORD :kbbug4.00 kbfix4.00 ------------------------------------------------------------------------------- The information in this article applies to: - Microsoft Windows NT Workstation version 4.0 - Microsoft Windows NT Server version 4.0 - Microsoft Windows NT Server, Enterprise Edition version 4.0 - Microsoft BackOffice Server versions 4.0, 4.5 - Microsoft BackOffice Small Business Server versions 4.0, 4.5 ------------------------------------------------------------------------------- SYMPTOMS ======== When you use Microsoft TCP/IP on a computer running Windows NT 4.0, you may be able to predict a session's initial sequence numbers (ISN). Someone can use this information to attack a computer by posing as a trusted user. RESOLUTION ========== A supported fix that corrects this problem is now available from Microsoft, but it has not been fully regression tested and should be applied only to systems experiencing this specific problem. If you are not severely affected by this specific problem, Microsoft recommends that you wait for the next Product Name service pack that contains this fix. To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web: http://www.microsoft.com/support/supportnet/overview/overview.asp The English language version of this fix should have the following file attributes or later: Date Time Size File name Platform -------------------------------------------------- 10/18/99 07:49p 171,696 Tcpip.sys x86 10/18/99 07:47p 305,712 Tcpip.sys Alpha NOTE: This fix was reposted on November 9, 1999 to resolve the following error message encountered while applying the hotfix: Hotfix setup has detected that the service pack version of the system installed is newer than the update you are applying to it. The following files are available for download from the Microsoft Download Center or Microsoft's FTP site. Click the file names below to download the appropriate file: x86: Microsoft Download Center: Q243835.exe (http://download.microsoft.com/download/winntsrv40/Patch/4.0.1381.7014/NT4/EN-US/Q243835.exe) FTP: Q243835.exe (ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP6/Security/Tcpip-fix/x86/) Alpha: Microsoft Download Center: Q243835.exe (http://download.microsoft.com/download/winntsrv40/Patch/4.0.1381.7014/ALPHA/EN-US/Q243835.exe) FTP: Q243835.exe (ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP6/Security/Tcpip-fix/Alpha/) For more information about how to download files from the Microsoft Download Center, please visit the Download Center at the following Web address http://www.microsoft.com/downloads/search.asp and then click "How to use the Microsoft Download Center". STATUS ====== Microsoft has confirmed this to be a problem in the Microsoft products listed at the beginning of this article. MORE INFORMATION ================ In the TCP/IP protocol suite, data is exchanged in the form of packets. Because of the way TCP/IP performs routing, the path taken by packets can change dynamically throughout a session. This means that if Host A and B are communicating and Host A sends two packets, they could potentially take different paths to Host B, and could arrive out of order. Host B must therefore have a way to re-assemble the packets in correct order. TCP/IP provides a way to do this using packet sequence numbers. Starting from an initial sequence number that each host provides as part of the session setup, each packet is assigned a sequence number that is one larger than that of its predecessor. For example, if Host B provides 123 as the initial sequence number for its session with Host A, Host A's first packet will be numbered 123, its second will be numbered 124, its third will be numbered 125, etc. If someone attempts to launch an attack against another computer and the attacker can predict how a host selects ISNs, it's possible to conduct two types of attacks, known as IP address spoofing and session hijacking. The more random the ISNs are, the more difficult it is to carry out these attacks. For related information on this problem, please visit the following Microsoft Web site: http://www.microsoft.com/security/bulletins/ms99-046faq.asp For additional security-related information about Microsoft products, please visit the following Microsoft Web site: http://www.microsoft.com/security/ Additional query words: ============================================================================ THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.