Check Point Advisories

Preemptive Protection against Microsoft Windows 'ipnathlp.dll' Denial of Service Vulnerability

Check Point Reference:	CPAI-2006-133
Date Published:	14 Nov 2006
Severity:	Medium
Last Updated:	Thursday 03 May, 2007
Source:	Secunia Advisory: SA22592
Industry Reference:	CVE-2006-5614
Protection Provided by:
Who is Vulnerable?	Microsoft Windows XP
Vulnerability Description	A denial of service vulnerability was detected in Microsoft Windows NAT Helper, a component of the Internet Connection Sharing service on Microsoft Windows XP. A remote attacker can exploit this vulnerability to terminate NT services on a target system.
Vulnerability Details	The vulnerability is due to a NULL pointer dereference error while Microsoft Windows NAT Helper components (ipnathelp.dll) fail to properly process a malformed DNS query. ipnathlp.dll is responsible for processing DNS queries submitted to the local network. A remote attacker on the internal network can exploit this vulnerability by sending a specially crafted DNS query to a vulnerable system and causing it to crash.