Re: MS05-019 Breaks VPN
From: Brian S. Bergin (b.b_at_TERABYTE.NET)
Date: Wed, 20 Apr 2005 23:09:12 -0400 To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
At 21:11 19-04-05 Tuesday, you wrote:
>After installing the update in Microsoft Security Bulletin MS05-019 on
>two servers at a customer site, we are no longer able to connect via VPN
>to terminal services on those servers. (Other servers that did not have
>the security bulletins from last Tuesday installed can connect via VPN.)
>After many hours over two days working with Microsoft Product Support
>Services, we discovered that forcing the MTU size down allowed the
>client to connect to terminal services. Today Microsoft PSS reported
>the they have confirmed that there is a problem with ICMP messages being
>incorrectly discarded (other have opened PSS cases about this issue).
>This could be why the MTU size is not being set correctly.
>There will be an update to the patch in MS05-019, but as of this time,
>that update is not available. A Microsoft KB article is being written
>and has been assigned the number KB898060, but as to this time, that
>article is not publicly available.
>I will be uninstalling the update for Security Bulletin MS05-019 from
>our customers servers this evening and waiting for the corrected patch
>before reinstalling it.
I don't believe this affects all systems. Our 2000 SP4 PPTP server
is not bothered by the problem described above and today I rebuilt a
Win2k SP4 VPN (MS PPTP) server for a customer when the old system's
HD died. Both boxes are fully patched with all Windows Updates and
HFNetChk 4.3 confirms there are no missing patches and PPTP works
great for the 15 or so VPN clients the customer has and they all hit
either a 2000 TS or their own XP Pro SP2 desktops inside their VPN
connection. Our customer is using a Cisco 3640 with IPFW installed
and the router is in NAT mode behind a T1 and we use a Cisco PIX on a
static IP ADSL connection. Both Cisco devices are setup to NAT the
PPTP traffic to the 2000 SP4 servers. This poster didn't state if
his box was 2000 or 2003, but on 2000 SP4 the problem he describes is
not evident on our systems.
Terabyte Computers, Inc.
Brian S. Bergin
-- NTBugtraq Editor's Note: Most viruses these days use spoofed email addresses. As such, using an Anti-Virus product which automatically notifies the perceived sender of a message it believes is infected may well cause more harm than good. Someone who did not actually send you a virus may receive the notification and scramble their support staff to find an infection which never existed in the first place. Suggest such notifications be disabled by whomever is responsible for your AV, or at least that the idea is considered. --