Vulnerability Note VU#32650
Denial of Service Attack in NetBIOS Services
The NetBIOS Name Service (NBNS) provides a means for hostname and address mapping on a NetBIOS-aware network. The NetBIOS over TCP/IP protocols (including NBNS) are described in the Internet Engineering Task Force (IETF) Request for Comments RFC1001 and RFC1002. These protocols do not specify a method for authenticating communications, and as such, machines running NetBIOS services are vulnerable to spoofing attacks.
NetBIOS is a set of defined software interfaces for vendor-independent PC networking and is primarily used on Microsoft Windows computers. NetBIOS is enabled by default on Windows95 and Windows98 machines.
An attacker sending spoofed "Name Release" or "Name Conflict" messages to a victim machine could force the victim to remove its own (legitimate) name from its name table and not respond to (or initiate) other NetBIOS requests. This renders the victim unable to communicate with other NetBIOS hosts, thus resulting in a denial-of-service attack.
An attacker can cause a victim's machine to refuse all NetBIOS network traffic, resulting in a denial of service.
Block NetBIOS services at the the network perimeter. NetBIOS services include
Furthermore, the CERT/CC recommends that sites, even those which do not use NetBIOS services, block all ports unless they are explicitly needed.
For additional information on securing Windows systems, see the following CERT/CC Tech Tips:
Windows 95/98 Computer Security Information
Windows NT Configuration Guidelines
Windows NT Security and Configuration Resources
RFC 1001, "Protocol Standard for a NetBIOS Service on a TCP/UDP Transport: Concepts and Methods":
RFC1002, "Protocol Standard for a NetBIOS Service on a TCP/UDP Transport: Detailed Specifications":
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Microsoft||Affected||-||03 Nov 2000|
CVSS Metrics (Learn More)
This document was written by Jeffrey P. Lanza and Chad Dougherty.
- CVE IDs: CVE-2000-0673
- Date Public: 27 Jul 2000
- Date First Published: 26 Sep 2000
- Date Last Updated: 29 Nov 2000
- Severity Metric: 8.10
- Document Revision: 8
If you have feedback, comments, or additional information about this vulnerability, please send us email.