search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Microsoft Windows 2000 SNMP service leaks memory when querying printer objects if spooler service is stopped

Vulnerability Note VU#887393

Original Release Date: 2002-10-24 | Last Revised: 2002-11-07

Overview

A memory leak exists in the Windows 2000 SNMP service. Under a specific precondition, it can result in a remote denial-of-service vulnerability.

Description

If the SNMP service is running on a Windows 2000 server, and the 'Print Spooler' service is not running, repeatedly using SNMP queries to obtain print queue related values in the LANMAN MIB will cause the SNMP service to consume very large amounts of memory. According to the NGS Software advisory, approximately 30MB of memory is allocated per SNMP request received. Multiple SNMP queries sent in short succession can readily consume all available memory on vulnerable systems. For additional information, see the NGS Software advisory and the Microsoft Knowledge Base Article.

Impact

The Windows 2000 server can be caused to crash when all available memory is exhausted, resulting in a denial of service condition.

Solution

Microsoft has addressed this vulnerability in Windows 2000 service pack 3 (SP3).

If you cannot upgrade to Windows 2000 SP3, the following steps may help to limit your exposure:

    • Disable the SNMP service on systems that do not require it.
    • Change community names from their default values. 'public' is commonly used for the read-only community name and 'private' is commonly used for the read-write name.
    • Permit SNMP queries from only authorized network managment stations using the 'Services' management snap-in. Filter queries from all other sources using a simple packet filter or an IPsec policy.

In general, we recommend a conservative, minimalist approach to network configuration. Therefore, these steps are recommended even for systems running SP3.

Vendor Information

887393
 
Affected   Unknown   Unaffected

Microsoft Corporation

Updated:  October 24, 2002

Status

  Vulnerable

Vendor Statement

See http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296815

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Acknowledgements

Thanks to Chris Anley for reporting this vulnerability.

This document was written by Chad R Dougherty.

Other Information

CVE IDs: None
Severity Metric: 4.86
Date Public: 2001-04-20
Date First Published: 2002-10-24
Date Last Updated: 2002-11-07 15:51 UTC
Document Revision: 19

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.