WINS update patch not installed header
| nt-winsupd-fix (1233) |  Medium Risk |
Description:
The WINS server for Windows NT 4.0 is vulnerable to a denial of service attack. An attacker could send random UDP packets to port 137 on a system running the WINS server to cause the server to crash.
Consequences:
Other
Remedy:
Apply the latest Windows NT 4.0 Service Pack (SP3 or later), available from the Windows NT Service Packs Web page. See References.
— OR —
As an alternative, Windows NT SP3 users can apply the post-SP3 winsupd-fix patch, as listed in Microsoft Knowledge Base Article Q155701. See References.
References:
- Microsoft Knowledge Base Article 155701: Invalid UDP Frames May Cause WINS to Terminate.
- Microsoft Product Support Services: windows NT Service Packs.
- BID-298: NT DoS Duplicate Hostname Vulnerability
- CVE-1999-0288: The WINS server in Microsoft Windows NT 4.0 before SP4 allows remote attackers to cause a denial of service (process termination) via invalid UDP frames to port 137 (NETBIOS Name Service), as demonstrated via a flood of random packets.
- CVE-1999-0662: A system-critical program or library does not have the appropriate patch, hotfix, or service pack installed, or is outdated or obsolete.
- OSVDB ID: 967: Microsoft Windows NT WINS Service Malformed Data DoS
Platforms Affected:
- Microsoft Windows NT 4.0
Reported:
Not available
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this