CVE-2005-1980

A remote attacker sends a crafted TIP message to the MSDTC service. When an error occurs during processing, the service repeatedly attempts to connect to a target IP address and port number specified in the message, causing the MSDTC service to hang [ref_id=1]. This results in a denial of service. The attack does not require authentication and can be launched over the network against systems where the MSDTC service is running and accessible.

The vulnerability resides in the Microsoft Distributed Transaction Coordinator (MSDTC) service, specifically in its handling of Transaction Internet Protocol (TIP) messages. The advisory does not name specific functions or files, but identifies the component as the Distributed Transaction Controller [ref_id=1].

The security update addresses the vulnerability by modifying how MSDTC handles TIP messages after an error occurs, preventing the repeated connection attempts that cause the service hang [ref_id=1]. Additionally, the update introduces several registry keys to further restrict TIP protocol behavior, such as disabling TIP by default on Windows 2000 and adding verification options for TM ID, port, BEGIN commands, and PULL commands [ref_id=1]. These changes reduce the attack surface and block the specific malformed message pattern that triggers the hang.