Vulnerability Note VU#32650

Denial of Service Attack in NetBIOS Services

NetBIOS is a set of defined software interfaces for vendor-independent PC networking and is primarily used on Microsoft Windows computers. NetBIOS is enabled by default on Windows95 and Windows98 machines.

I. Description

• NetBIOS Name Service, 137/tcp and 137/udp
• NetBIOS Datagram Service, 138/tcp and 138/udp
• NetBIOS Session Service, 139/tcp and 139/udp

Note that this prevents external hosts from sending NetBIOS Name Service traffic to internal machines, but it does not prevent local users from exploiting this vulnerability.

Furthermore, the CERT/CC recommends that sites, even those which do not use NetBIOS services, block all ports unless they are explicitly needed.

• For Windows NT and Windows 2000, apply the patches recommended in Microsoft Security Bulletin MS00-047:

http://www.microsoft.com/technet/security/bulletin/ms00-047.asp

http://www.microsoft.com/technet/security/bulletin/fq00-047.asp

Note that no patch is being furnished for Win9x systems; Microsoft has publicly stated that patching these systems to disable name conflict resolution would cause more problems than it would help prevent, especially in networks with large numbers of Win9x systems.

• Use IPSec to help secure internal IP communication. Information about configuring IPSec in Windows 2000 can be found at
  
  http://www.microsoft.com/WINDOWS2000/library/planning/security/ipsecsteps.asp
  
  http://www.microsoft.com/WINDOWS2000/library/howitworks/security/ip_security.asp

For additional information on securing Windows systems, see the following CERT/CC Tech Tips:

Windows 95/98 Computer Security Information

Windows NT Configuration Guidelines

Windows NT Security and Configuration Resources

RFC 1001, "Protocol Standard for a NetBIOS Service on a TCP/UDP Transport: Concepts and Methods":

http://www.ietf.org/rfc/rfc1001.txt

RFC1002, "Protocol Standard for a NetBIOS Service on a TCP/UDP Transport: Detailed Specifications":

http://www.ietf.org/rfc/rfc1002.txt

http://pr0n.newhackcity.net/~sd/nbname.html
http://pr0n.newhackcity.net/~sd/netbios.html
http://www.cultdeadcow.com
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0673
http://www.defcon.org
http://www.fcw.com/fcw/articles/2000/0731/web-defcon-08-02-00.asp
http://www.ietf.org/rfc/rfc1001.txt
http://www.ietf.org/rfc/rfc1002.txt
http://www.ietf.org/html.charters/ipsec-charter.html
http://www.microsoft.com/technet/security/bulletin/ms00-047.asp
http://www.microsoft.com/technet/security/bulletin/fq00-047.asp
http://www.microsoft.com/TechNet/security/ipsecimp.asp
http://www.pgp.com/research/covert/advisories/044.asp
http://www.securityfocus.com/bid/1514
http://www.securityfocus.com/bid/1515
http://www.securityfocus.com/tools/1670

Credit

This document was written by Jeffrey P. Lanza and Chad Dougherty.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.