CVE-2005-1979

A remote attacker sends an "unexpected protocol command during the reconnection request" to the MSDTC service, which the TIP functionality does not properly handle [ref_id=1]. This causes the MSDTC service to throw an exception and exit, resulting in a denial of service. The attacker does not need authentication; the vulnerability can be triggered over the network by any remote server sending a malformed TIP reconnection request.

The vulnerability resides in the Transaction Internet Protocol (TIP) functionality of the Microsoft Distributed Transaction Coordinator (MSDTC) service. The advisory does not specify exact function or file names, but identifies the TIP protocol handling as the affected code path [ref_id=1].

The security update addresses the vulnerability by improving how the MSDTC service validates TIP protocol commands during reconnection requests [ref_id=1]. Additionally, the update introduces several registry-based mitigations: TIP can be disabled entirely on Windows 2000 via the NetworkDtcAccessTip key, and four new registry values (DisableTipTmIdVerfication, DisableTipTmIdPortVerification, DisableTipBeginCheck, DisableTipPassThruCheck) allow administrators to enforce stricter validation of TIP packets, such as verifying the TM ID matches the sender's IP address and requiring port 3372 [ref_id=1].