Vulnerability Note VU#887393

Microsoft Windows 2000 SNMP service leaks memory when querying printer objects if spooler service is stopped

Overview

A memory leak exists in the Windows 2000 SNMP service. Under a specific precondition, it can result in a remote denial-of-service vulnerability.

I. Description

If the SNMP service is running on a Windows 2000 server, and the 'Print Spooler' service is not running, repeatedly using SNMP queries to obtain print queue related values in the LANMAN MIB will cause the SNMP service to consume very large amounts of memory. According to the NGS Software advisory, approximately 30MB of memory is allocated per SNMP request received. Multiple SNMP queries sent in short succession can readily consume all available memory on vulnerable systems. For additional information, see the NGS Software advisory and the Microsoft Knowledge Base Article.

II. Impact

The Windows 2000 server can be caused to crash when all available memory is exhausted, resulting in a denial of service condition.

III. Solution

Microsoft has addressed this vulnerability in Windows 2000 service pack 3 (SP3).

If you cannot upgrade to Windows 2000 SP3, the following steps may help to limit your exposure:

Disable the SNMP service on systems that do not require it.
Change community names from their default values. 'public' is commonly used for the read-only community name and 'private' is commonly used for the read-write name.
Permit SNMP queries from only authorized network managment stations using the 'Services' management snap-in. Filter queries from all other sources using a simple packet filter or an IPsec policy.

In general, we recommend a conservative, minimalist approach to network configuration. Therefore, these steps are recommended even for systems running SP3.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Microsoft Corporation	Vulnerable	24-Oct-2002

References

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296815
http://www.ngssoftware.com/advisories/snmp_dos.txt
http://www.securityfocus.com/bid/6030

Credit

Thanks to Chris Anley for reporting this vulnerability.

This document was written by Chad R Dougherty.

Other Information

Date Public:	2001-04-20
Date First Published:	2002-10-24
Date Last Updated:	2002-11-07
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	4.86
Document Revision:	19

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader