Microsoft Windows Media Services 4.0 & 4.1 Security Patch: Severed Windows Media Server Connection Vulnerability 12-15-00

If a connection to a server running the Windows Media Unicast Service was started, then severed, in a particular way, the service would “leak” some of the resources that were allocated during the connection. If this sequence of commands was repeated enough times, it could degrade the server’s performance to the point where it would no longer be able to provide useful service.When a connection to a Windows Media server is made, then severed, using a particular sequence of TCP/IP packets, the Windows Media Unicast Service does not release all of the resources allocated to the connection. By repeatedly making and then severing connections in this manner, a malicious user could exhaust the resources on a server, thereby preventing it from providing streaming media services.If an affected server were attacked via this vulnerability, the server operator could restore normal operation by restarting the Windows Media Service. Any sessions that were in progress would be lost, but users could immediately reconnect and resume normal use. Note: Windows Media Services 4.1 ships as part of Windows 2000, and the patch for Windows Media Services 4.1 can be applied atop Windows 2000 Gold or SP1. Windows Media Services 4.0 does not ship as part of any other product. The patch for Windows Media Services 4.0 can be applied to any machine already running the product.