FYI…

- http://www.pcworld.com/printable/article/i…/printable.html
October 30, 2006

- http://isc.sans.org/diary.php?storyid=1809
Last Updated: 2006-10-29 20:29:35 UTC
"We have received a report that a DoS exploit has been released that targets ipnathlp.dll, which is used by the Windows Firewall/Internet Connection Sharing (ICS) service. We also received a report that the exploit works against a fully patched XP SP2 system… The Windows Firewall/Internet Connection Sharing (ICS) service may be running even though Windows Firewall is disabled.
To determine if your system has the service running, type the following at a command prompt:
sc query sharedaccess
The short name of this service is SharedAccess, the full name is Windows Firewall/Internet Connection Sharing (ICS).
…Microsoft Error Message:
'Generic Host Process for Win32 Services has encountered a problem and needs to close. We are sorry for the inconvenience.'
View What's in this report:
Error signature:
szAppName: svchost.exe szAppVer: 5.1.2600.2180
szModName: ipnathlp.dll szModVer 5.1.2600.2180 offset: 0001d45e …
Other information;
UPDATE - 5:40 PM EDST - According to the MS Windows Compute Cluster Server 2003 Deployment website*, "Windows Compute Cluster Server 2003 relies on Internet Connection Sharing (ICS) to provide network address translation between the public and private networks. ICS also provides DHCP service for the private network. ICS is enabled during Compute Cluster Pack setup".
SharedAccess — Windows Firewall/Internet Connection Sharing (ICS).
Provides network address translation, addressing, name resolution, and/or intrusion prevention services for a home or small office network.
Start mode: Auto
Login account: LocalSystem
DLL file: ipnathlp.dll
Dependencies: Netman, winmgmt
SharedAccess — Windows Firewall/Internet Connection Sharing (ICS).
Provides network address translation, addressing, name resolution, and/or intrusion prevention services for a home or small office network.
Start mode: Auto
Login account: LocalSystem
DLL file: ipnathlp.dll
Dependencies: Netman, winmgmt
> msdn Diagram of Internet Connection Sharing and Internet Connection Firewall
> http://msdn.microsoft.com/library/en-us/ic…on_firewall.asp

* http://technet2.microsoft.com/WindowsServe…33.mspx?pf=true

MS ICS DoS 0Day in the Wild - ICS DoS FAQ
** http://blog.ncircle.com/archives/2006/10/microsoft_ics_d.htm

- http://secunia.com/advisories/22592/
Release Date: 2006-10-30
Critical: Less critical
Impact: DoS
Where: From local network
Solution Status: Unpatched
OS: Microsoft Windows XP Home, XP Professional
…The vulnerability is confirmed in a fully patched Windows XP SP2 system. Other versions may also be affected.
Solution: Use another way of sharing the Internet connection…
=============================================
BTW…
- http://www.sans.org/newsletters/newsbites/…mp;rss=Y#sID204

"…the attack would have no effect on a third-party firewall…"

.