IrDA semiremote vulnerability

[Paul Millar <paulm () astro gla ac uk>]

----[ Win2k semi-remote DoS via IrDA

Synopsis:
  There exists a "semi-remote" vulnerability against Windows machines
  via the IrDA port. The result of exploiting this vulnerability is
  the computer will crash, displaying a "Blue Screen of Death" (BSOD),
  shortly followed by rebooting.  As IrDA ports are mostly found on
  laptops, these machines are more likely to be exploitable. Limited
  test data suggests this attack is successful against Windows 2000
  Professional machines, but not successful against machines running
  Windows 98. Other OS versions have not been tested.


Symptom:
  Machine crashes with BSOD. After a few seconds machine reboots.


Trigger:
  Receiving an IrDA test frame. These can be generated by the irdaping
  utility under GNU/Linux


Affected:
  Windows 2000 Professional


Not affected:
  Windows 98


Work-around:
  Disable the IrDA port under the Device Manager. The truely paranoid
  can place Insulation/PVC tape over the port to prevent abuse.


Recreate:
  1. Startup laptops. My setup was: victim running Windows, protagonist
     running GNU/Linux. The Linux kernel must have IrDA support
     compiled in.
  2. Under GNU/Linux, make sure irda-utils-0.9.10-9 is installed, other
     versions are untested, but will probably work too.
  3. Do "irattach /dev/ttyS1 -s" or equivalent to activate the IrDA
     port.
  4. Check the GNU/Linux side its working correctly by running the
     "irdadump" command. You should see repetitive output similar to:

07:28:17.790903 xid:cmd 4d274896 > ffffffff S=6 s=0 (14)
07:28:17.880849 xid:cmd 4d274896 > ffffffff S=6 s=1 (14)
07:28:17.970845 xid:cmd 4d274896 > ffffffff S=6 s=2 (14)
07:28:18.060858 xid:cmd 4d274896 > ffffffff S=6 s=3 (14)
07:28:18.150840 xid:cmd 4d274896 > ffffffff S=6 s=4 (14)
07:28:18.240861 xid:cmd 4d274896 > ffffffff S=6 s=5 (14)
07:28:18.330859 xid:cmd 4d274896 > ffffffff S=6 s=* rattusrattus hint=0400 [ Computer ] (28)

  5. Place laptops so the infrared ports are aligned and within IrDA
     distance, irdadump should reflect new machine. The windows
     machine should also respond, usually by making a sound.
  6. Run irdaping. The destination address ("0x4d274896"
     for above example) is required, but actual value doesn't matter.
  7. Victim machine should display the BSOD at this point and reboot.


Systems tested that were vulnerable:
  [] OEM laptop, Windows 2000 Professional service pack 2 v5.00.2195,
     National Semiconductor IrDA.
     Options:
        Infrared Trans. A: HP HSDL-1100/2100,
        Infrared Trans. B SIR Transceiver,
        Max Con. Rate: 4Mbps.
     Driver National Semiconductor 9/8/1999 v1.0.0.0 (signed MS 2000
     Publisher)

  [] Toshiba Satellite Pro 4000, Windows 2000 Professional service pack 2
     v5.00.2195, SMC IrCC IrDA.
     Options:
        Fast Infrared Port: Infrared
        Transceiver Type: auto,
        Min. Turn-Around Time: 1.0mS,
        Speed Limit: 4 Mbps,
     Driver: SMC 22/10/2000 v4.10.1999.5 (signed MS comp).

  [] Acer TravelMate 527TE P3-700MHz, Windows 2000 Professional


Systems tested that were not vulnerable:
  [] Dell Inspiron 3200 D233XT TS30H, Windows 98 SE 4.10.1998 32Mb P2,
     IrDA driver (Microsoft 5-11-1998)
         [Thanks Jen!]

  [] IBM ThinkPad T21, Windows 98 SE 4.10.2222 A 128Mb P3, IrDA driver
     (Microsoft 4-23-1999)


Discussion:  
  After discovering the problem, a quick searched using Google
  revealed that Kevin Gottsman reported the same effect [1] back in
  December 2000 but only to "The Pasta Projects Linux-IrDA Forum"
  mailing list. The problem didn't appear on the vulnerabilities
  database at SecurityFocus [2], or on Microsoft's own website [3].

  Microsoft were notified on July 4th 2001 and were able to quickly
  verify the problem.  Their investigation suggests that the problem
  is driver specific (as Kevin suggested) and that it cannot cause
  remote code execution.

  A patch has been developed, see Microsoft bulletin MS01-046 [4] for
  details.

  From limited experimentation, disabling communication via the IrDA
  software does not prevent the vulnerability, the whole device must
  be disabled under the Device Manager to prevent the system from
  crashing.


Acknowledgments:
  Thanks are due (in no particular order) to jools }B->, Tom How,
  Ritchie, Jen and Graham Woan for providing the cannon fodder:
  Windows isn't really my thing.


[1] http://www.pasta.cs.uit.no/pipermail/linux-irda/2000-December/002144.html
[2] http://www.securityfocus.com/
[3] http://www.microsoft.com/technet/security/
  (following URL wraps)
[4] http://www.microsoft.com/technet/treeview/default.asp?url=/technet/sec
    urity/bulletin/MS01-046.asp

This vulnerability description is (c) 2001 Paul Millar
(paulm () astro gla ac uk -- please remember the `m'). Reproduction,
either partial or complete is permitted provided either this copyright
notice is reproduced in its entirety, or provision is make to direct
future readers to an instance of the complete copyright notice. This
does not affect `fair usage'.