List of Networking Fixes in Windows 2000 Service Pack 3 (324947)

SUMMARY

• Multiple IP Addresses on a TCP/IP Interface May Cause a Stop 0x50 Error in Tcpip.sys
  
  In a multi-threaded IP situation, under a heavy load, one thread may read data and be interrupted. When it resumes processing, it overwrites changes made by another thread. This causes a Stop error (an error message on a blue screen) in Tcpip.sys.
• TAPISRV May Process Messages in an Incorrect Order on Multi-Processor Computer
  
  This update makes sure that the Telephone API (TAPI) server processes LINE_NEWCALL and conferencing messages in the correct order.
• Socket Duplication Fails with Connection Reset (CONNRESET)
  
  Socket duplication may be unsuccessful in the following situations:
  • Information about the graceful close of the socket by the remote side is lost when the local side tries to duplicate the socket into a different process.
  • Repeatedly duplicating the same socket may cause a program to stop responding (hang).
• Routing and Remote Access IGMP Group Table Does Not Show Correct Groups
  
  When you configure Internet Group Management Protocol (IGMP) with two interfaces, the ServerName - IGMP Group Table dialog box does not display the correct groups.
• GetAdapterIndex() API Returns an Invalid Interface Index When a Null String Is Passed As the Adapter Name
  
  When a NULL or an invalid adapter name is passed, the GetAdapterIndex() Application Programming Interface (API) succeeds and returns an index.
• Fatal System Error 0x0000007F When an Invalid TC Object Length Is Passed
  
  If an invalid Quality of Service (QoS) traffic control (TC) object length is passed to the Packet Scheduler (Psched.sys), a fatal system error (STOP 0x0000007F) occurs.
• "Race" Condition in Remote Procedure Call (RPC) Runtime Shut Down Process
  
  The RpcMgmtWaitServerListen() function returns without waiting for all active calls to complete.
• Packets Re-classify to a Different Flow
  
  If you modify a less-specific Quality of Service (QoS) flow when more than one flow is installed, packets that were classified to a more-specific flow classify to the modified flow.
• Stop Error Occurs When Accessing a Field in the Time-Wait Transmission Control Block (TWTCB) After It Has Been Freed
• Remote Procedure Call (RPC) Attack on the Microsoft Message Queue Interface (Also Known As MSMQ) May Cause RPC to Stop Responding (Crash)
• Resource-Related Denial of Service Attack Causes Too Much Memory Allocation on the Server
  
  This update minimizes the effect of resource-related attacks by delaying memory allocation and checking for illegal pointers.
• Remote Procedure Call Attack Causes RPCSS.EXE to Stop Responding (Crash)
• Remote Procedure Call (RPC) Stack Corruption Occurs Under Heavy Stress
  
  Under a heavy load, the following RPC stack corruptions may occur:
  • RPC code places two RPC_MESSAGE structures on the stack but passes the addresses of these structures to functions that take asynchronous code paths. When the work is complete, the stack is corrupted by the completion routines.
  • When a sending packet times out, the completion routine still holds the address of the return buffer that was on the stack.
• Remote Procedure Call (RPC) Endpoint Mapper Does Not Look for NULL Error Parameter
  
  When you pass a NULL buffer pointer to the endpoint mapper functions for status information, an access violation (AV) occurs.
• Routing and Remote Access Service Stops Responding When You Use the NET STOP Command
  
  When you use the net stop "routing and remote access" command to stop the Routing and Remote Access service, the service may stop responding and may continue to run.
• SNMP Event to Trap Translator Does Not Release the Handle to the HKEY_PERFORMANCE_DATA Registry Key
• Access Violation (AV) in SVCHOST.EXE
  
  Casually ordered Local Remote Procedure Calls (LRPC) may cause access violations (AV) in Svchost.exe.
• CookupNodeId Functions Use Non-Initialized Memory
  
  This update initializes LocalNodeId to meet C2 Security requirements.
• Buffer Overrun in DHCP Client Service
  
  The Dynamic Host Configuration Protocol (DHCP) client overruns its buffer when the total size of user classes configured on the DHCP server exceeds 255 bytes.
• Access Violation in DHCP Jet Database When You Upgrade from Windows NT 4.0
  
  When you upgrade a Windows NT 4.0 server on which the Dynamic Host Configuration Protocol (DHCP) service is installed to Windows 2000 Service Pack 2 (SP2), you may receive an error message similar to the following:
  The DHCP database upgrade was unsuccessful.
• Call Status Dialog Box Does Not Appear When Calling an Outlook Contact
  
  The Windows 2000 Unimodem lacks the feature to display the call status dialog box when you place a voice call on a data modem. This update adds code to correctly display this dialog box.