MS03-034: Flaw in NetBIOS...

[Steven]

-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------

Title: Flaw in NetBIOS Could Lead to Information Disclosure

(824105)

Date: 03 September 2003

Software:

- Microsoft Windows NT 4.0 Server

- Microsoft Windows NT 4.0, Terminal Server Edition

- Microsoft Windows 2000

- Microsoft Windows XP

- Microsoft Windows Server 2003

Impact: Information Disclosure

Max Risk: Low

Bulletin: MS03-034

Microsoft encourages customers to review the Security Bulletins at:

http://www.microsoft.com/technet/security/...in/MS03-034.asp

http://www.microsoft.com/security/security...ns/ms03-034.asp

- ----------------------------------------------------------------------

Issue:

======

Network basic input/output system (NetBIOS) is an application

programming interface (API) that can be used by programs on a local

area network (LAN). NetBIOS provides programs with a uniform set of

commands for requesting the lower-level services required to manage

names, conduct sessions, and send datagrams between nodes on a

network.

This vulnerability involves one of the NetBT (NetBIOS over TCP)

services, namely, the NetBIOS Name Service (NBNS). NBNS is

analogous to DNS in the TCP/IP world and it provides a way to find

a system's IP address given its NetBIOS name, or vice versa.

Under certain conditions, the response to a NetBT Name Service

query may, in addition to the typical reply, contain random data

from the target system's memory. This data could, for example, be a

segment of HTML if the user on the target system was using an

Internet browser, or it could contain other types of data that

exist in memory at the time that the target system responds to the

NetBT Name Service query.

An attacker could seek to exploit this vulnerability by sending a

NetBT Name Service query to the target system and then examine the

response to see if it included any random data from that system's

memory.

If best security practices have been followed and port 137 UDP has

been blocked at the firewall, Internet based attacks would not be

possible.

Mitigating Factors:

====================

- Any information disclosure would be completely random.

- By default, the Internet Connection Firewall (ICF), which is

available with Windows XP and Windows Server 2003, blocks the

ports that are used by NetBT.

- To exploit this vulnerability, an attacker would have to be able

to send a specially-crafted NetBT request to port 137 on the

target system and then examine the response to see whether any

random data from that system's memory is included. In intranet

environments, these ports are usually accessible, but systems that

are connected to the Internet usually have these ports blocked

by a firewall.

Risk Rating:

============

- Low

Patch Availability:

===================

- A patch is available to fix this vulnerability. Please read

the Security Bulletins at

http://www.microsoft.com/technet/security/...in/ms03-034.asp

http://www.microsoft.com/security/security...ns/ms03-034.asp

for information on obtaining this patch.

Acknowledgment:

===============

Mike Price of Foundstone Labs, http://www.foundstone.com

- ---------------------------------------------------------------------

Edited September 4, 2003 by xStainDx