Windows 95 SMB Exploits and Security Fixes

During the mid-to-late 1990s, early implementations of the Server Message Block (SMB) and NetBIOS protocols in Microsoft Windows 95 suffered from critical security vulnerabilities. These flaws exposed systems to remote denial-of-service (DoS) crashes, unauthorized share access, and credential theft over local networks and the early public internet. This article details the specific vulnerabilities discovered in Windows 95's SMB implementation and the official security patches Microsoft released to mitigate them.

VSERVER Share-Level Password Bypass Patch

One of the earliest remote SMB flaws in Windows 95 resided in the file and printer sharing driver, VSERVER.VXD. When share-level access control was enabled, a logic flaw in how the driver validated incoming SMB connection requests allowed remote attackers to bypass password protection entirely.

  • Vulnerability: The driver used a faulty string comparison routine that verified only the length of the supplied password rather than the full character match. By sending an empty password string or a single character repeatedly, an attacker could mount protected shares without authenticating.
  • The Fix: Microsoft released an updated driver package, VSERVUPD.EXE (replacing VSERVER.VXD), in late 1995. This update corrected the SMB password-validation routine to enforce full string authentication against share passwords.

MS97-004: NetBIOS/SMB Out-of-Band Denial of Service (WinNuke)

In May 1997, security researchers identified a severe remote denial-of-service vulnerability targeting port 139 (NetBIOS Session Service, the transport used by Windows 95 for SMB traffic), commonly referred to as "WinNuke."

  • Vulnerability: Sending Out-of-Band (OOB) data via TCP port 139 triggered an unhandled exception in the Windows 95 networking stack. The system could not process the unexpected pointer flag, causing an immediate Blue Screen of Death (BSOD) or a hard system lockup requiring a physical reboot.
  • The Fix: Microsoft issued Security Bulletin MS97-004 alongside a hotfix package (WN950410.EXE). The patch modified core networking drivers (VIP.386 and TCPSTK.DLL) to properly handle and discard OOB data frames arriving over TCP connections.

LM Hash and SMB Credential Transmission Updates

By default, Windows 95 used the weak LAN Manager (LM) authentication protocol over SMB connections. The protocol relied on DES-based LM hashes, which split passwords into two 7-character halves and converted them to uppercase, making them trivial to crack through eavesdropping or SMB relay attacks.

  • Vulnerability: When attempting to access remote SMB shares, Windows 95 automatically transmitted weak LM hashes across the network without user confirmation, exposing passwords to anyone running a packet sniffer on the subnet.
  • The Fix: Microsoft introduced the Windows 95 NTLM Security Support Provider (NTLMSSP) update. This hotfix introduced the more resilient NTLM protocol to Windows 95, allowing the client to negotiate secure authentication challenges with Windows NT servers and reduce exposure over SMB.

SMB Signing and NTLMv2 Support

Later in Windows 95's lifecycle, vulnerabilities involving SMB man-in-the-middle (MitM) attacks became prevalent. Attackers could intercept SMB sessions to alter commands or hijack authenticated sessions.

  • The Fix: Microsoft released the Directory Services Client (DSClient) update for Windows 95. In addition to enabling Active Directory compatibility, this package added support for SMB packet signing and NTLMv2 authentication. SMB signing forced the client and server to cryptographically sign every SMB packet, neutralizing remote session hijacking and tampering.