Vulnerability Note VU#445214

Microsoft Windows Internet Naming Service (WINS) fails to properly validate the length of specially crafted packets

According to Microsoft, this vulnerability will only cause a denial of service on Windows Server 2003. While the vulnerable code exists in Windows NT and Windows 2000, WINS will reject the specially crafted packet thus not causing a denial of service.

II. Impact

Apply the patch (830352) referenced in Microsoft Security Bulletin MS04-006.

Block or restrict access

As a temporary measure, it is possible to limit the scope of this vulnerability by blocking access to ports used to initiate a connection with a remote WINS server at the network perimeter. These are typically ports 42/tcp and 137/udp. Please note that this workaround does not protect vulnerable WINS servers from internal attacks.

Disable vulnerable service

Disable WINS until a patch can be applied. As a best practice, the CERT/CC recommends disabling all services that are not explicitly required.

Systems Affected

http://www.microsoft.com/technet/security/bulletin/MS04-006.asp
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/proddocs/entserver/sag_WINS_ovr_WhatIs.asp

Credit

This vulnerability was reported by Microsoft. Microsoft, in turn, credits Qualys for discovering this vulnerability.

This document was written by Damon Morda.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.