A memory leak exists in the Windows 2000 SNMP service. Under a specific precondition, it can result in a remote denial-of-service vulnerability.
If the SNMP service is running on a Windows 2000 server, and the 'Print Spooler' service is not running, repeatedly using SNMP queries to obtain print queue related values in the LANMAN MIB will cause the SNMP service to consume very large amounts of memory. According to the NGS Software advisory, approximately 30MB of memory is allocated per SNMP request received. Multiple SNMP queries sent in short succession can readily consume all available memory on vulnerable systems. For additional information, see the NGS Software advisory and the Microsoft Knowledge Base Article.
The Windows 2000 server can be caused to crash when all available memory is exhausted, resulting in a denial of service condition.
Microsoft has addressed this vulnerability in Windows 2000 service pack 3 (SP3).
If you cannot upgrade to Windows 2000 SP3, the following steps may help to limit your exposure:
In general, we recommend a conservative, minimalist approach to network configuration. Therefore, these steps are recommended even for systems running SP3.
Thanks to Chris Anley for reporting this vulnerability.
This document was written by Chad R Dougherty.
|Date First Published:||2002-10-24|
|Date Last Updated:||2002-11-07 15:51 UTC|