Re: MS05-019 Breaks VPN

This may sound a little off-topic, but I've found appropriate to remind
about last MS VPN related announcements.

On Windows XP SP2, Microsoft changed the default behavior of IPSec
NAT-Traversal to disable. That means that any Microsoft L2TP/IPSec VPN
Client behind a NAT device will fail to negotiate security (IKE) and
thus establish a VPN tunnel. This can be bypassed by manually editing
the registry:
http://support.microsoft.com/default.aspx?kbid=885407

Since then, Microsoft is also NOT recommending NAT-Traversal on Windows
Server 2003 boxes:
http://support.microsoft.com/kb/885348/

Some NAT-Safe scenarios are:

1) PPTP VPNs, since they do not relies in any kind of integrity protocol
(e.g.: AH/ESP) as IPsec does. 
2) Systems connected directly with public addresses.

Cheers,
Arley Silveira.
MCP+I MCSA MCSE iNET+ CIW-A OCP

-----Original Message-----
From: Windows NTBugtraq Mailing List
[mailto:[email protected]] On Behalf Of Brian S. Bergin
Sent: quinta-feira, 21 de Abril de 2005 4:09
To: [email protected]
Subject: Re: MS05-019 Breaks VPN

At 21:11 19-04-05 Tuesday, you wrote:
>After installing the update in Microsoft Security Bulletin MS05-019 on 
>two servers at a customer site, we are no longer able to connect via 
>VPN to terminal services on those servers.  (Other servers that did not

>have the security bulletins from last Tuesday installed can connect via

>VPN.)
>
>After many hours over two days working with Microsoft Product Support 
>Services, we discovered that forcing the MTU size down allowed the 
>client to connect to terminal services.  Today Microsoft PSS reported 
>the they have confirmed that there is a problem with ICMP messages 
>being incorrectly discarded (other have opened PSS cases about this
issue).
>This could be why the MTU size is not being set correctly.
>
>There will be an update to the patch in MS05-019, but as of this time, 
>that update is not available.  A Microsoft KB article is being written 
>and has been assigned the number KB898060, but as to this time, that 
>article is not publicly available.
>
>I will be uninstalling the update for Security Bulletin MS05-019 from 
>our customers servers this evening and waiting for the corrected patch 
>before reinstalling it.

I don't believe this affects all systems.  Our 2000 SP4 PPTP server is
not bothered by the problem described above and today I rebuilt a Win2k
SP4 VPN (MS PPTP) server for a customer when the old system's HD died.
Both boxes are fully patched with all Windows Updates and HFNetChk 4.3
confirms there are no missing patches and PPTP works great for the 15 or
so VPN clients the customer has and they all hit either a 2000 TS or
their own XP Pro SP2 desktops inside their VPN connection.  Our customer
is using a Cisco 3640 with IPFW installed and the router is in NAT mode
behind a T1 and we use a Cisco PIX on a static IP ADSL connection.  Both
Cisco devices are setup to NAT the PPTP traffic to the 2000 SP4 servers.
This poster didn't state if his box was 2000 or 2003, but on 2000 SP4
the problem he describes is not evident on our systems.

Sincerely,
Terabyte Computers, Inc.

Brian S. Bergin
President

http://www.terabyte.net

--
NTBugtraq Editor's Note:

Most viruses these days use spoofed email addresses. As such, using an
Anti-Virus product which automatically notifies the perceived sender of
a message it believes is infected may well cause more harm than good.
Someone who did not actually send you a virus may receive the
notification and scramble their support staff to find an infection which
never existed in the first place. Suggest such notifications be disabled
by whomever is responsible for your AV, or at least that the idea is
considered.
--

--
NTBugtraq Editor's Note:

Most viruses these days use spoofed email addresses. As such, using an Anti-Virus product which automatically notifies the perceived sender of a message it believes is infected may well cause more harm than good. Someone who did not actually send you a virus may receive the notification and scramble their support staff to find an infection which never existed in the first place. Suggest such notifications be disabled by whomever is responsible for your AV, or at least that the idea is considered.
--