Microsoft Windows NT/2000/XP SMB packet request buffer overflow
| win-smb-packet-bo (9933) |  High Risk |
Description:
Microsoft Windows NT, Windows 2000, and Windows XP are vulnerable to a denial of service attack, caused by a buffer overflow in the Server Message Block (SMB) protocol service. By sending a specially-crafted SMB_CON_TRANSACTION packet that requests the NetServerEnum2, NetServerEnum3, or NetShareEnum function, a remote attacker could overflow a buffer and cause the system to crash. This vulnerability could be exploited by both an attacker with a legitimate user account and an attacker with anonymous access to the system.
Note: This vulnerability also affects multiple Cisco products that use one of the vulnerable versions of Microsoft Windows.
Platforms Affected:
- Cisco, ACS Solution Engine
- Cisco, Broadband Troubleshooter
- Cisco, Building Broadband Service Manager
- Cisco, CiscoWorks 2000 Service Management Solution
- Cisco, CNS Network Registrar
- Cisco, Collaboration Server
- Cisco, DOCSIS CPE Configurator
- Cisco, Dynamic Content Adapter
- Cisco, E-Mail Manager
- Cisco, Intelligent Contact Manager
- Cisco, Media Blender (CMB)
- Cisco, Secure Policy Manager
- Cisco, TrailHead
- Cisco, Transport Manager
- Cisco, Unified CallManager 3.0
- Cisco, Unified CallManager 3.1
- Cisco, Unified CallManager 3.2
- Cisco, Unity Server
- Cisco, uOne Enterprise Edition
- Cisco, User Registration Tool
- Microsoft, Windows 2000
- Microsoft, Windows 2000 Professional
- Microsoft, Windows 2000 Server
- Microsoft, Windows 2000 Advanced Server
- Microsoft, Windows 2003 Server
- Microsoft, Windows NT 4.0
- Microsoft, Windows NT 4.0 Terminal Server
- Microsoft, Windows XP Professional
Remedy:
For vulnerability detection:
Enable the following checks in the ISS Protection Platform:
WinSmbPacketBo
MS02-045
Enable the following checks in the ISS Protection Platform:
SMB_Transact_Bo
Block or restrict the following in the ISS Protection Platform as appropriate to the environment:
Port 445
For Manual Protection:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS02-045. See References.
For Cisco CallManager 3.0.x, 3.1.x, and 3.2.x:
Upgrade to the latest software version, as listed in Cisco Security Advisory: Microsoft Windows SMB Denial of Service Vulnerabilities in Cisco Products - MS02-045. See References.
For Cisco ICS 7750 1.x and 2.x:
Upgrade to the latest software version, as listed in Cisco Security Advisory: Microsoft Windows SMB Denial of Service Vulnerabilities in Cisco Products - MS02-045. See References.
For all other affected Cisco products:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS02-045. See References.
Consequences:
Gain Access
References:
- Cisco Systems Inc. Security Advisory, 2002 September 18 16:00 (UTC -0400), Microsoft Windows SMB Denial of Service Vulnerabilities in Cisco Products - MS02-045 at http://www.cisco.com/warp/public/707/Microsoft-SMB-vulnerability-MS02-045-pub.shtml.
- Core Security Technologies Advisory CORE-20020618, Denial of Service Vulnerabilities in Windows SMB implementation at http://www.corest.com/common/showdoc.php?idxseccion=10&idx=262.
- Internet Security Systems Security Alert, August 29, 2002, Microsoft Windows SMB Denial of Service Vulnerability at http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21061.
- Microsoft Knowledge Base Article 326830, MS02-045: Unchecked Buffer in Network Share Provider May Lead to Denial-of-Service at http://support.microsoft.com/default.aspx?scid=kb;[LN];326830.
- Microsoft Security Bulletin MS02-045, Unchecked Buffer in Network Share Provider Can Lead to Denial of Service (Q326830) at http://www.microsoft.com/technet/security/bulletin/ms02-045.mspx.
- BID-5556: Microsoft Network Share Provider SMB Request Buffer Overflow Vulnerability
- CVE-2002-0724: Buffer overflow in SMB (Server Message Block) protocol in Microsoft Windows NT, Windows 2000, and Windows XP allows attackers to cause a denial of service (crash) via a SMB_COM_TRANSACTION packet with a request for the (1) NetShareEnum, (2) NetServerEnum2, or (3) NetServerEnum3, aka Unchecked Buffer in Network Share Provider Can Lead to Denial of Service.
- US-CERT VU#250635: Microsoft Windows Server Message Block (SMB) fails to properly handle SMB_COM_TRANSACTION packets requesting NetServerEnum2 transaction
- US-CERT VU#311619: Microsoft Windows Server Message Block (SMB) fails to properly handle SMB_COM_TRANSACTION packets requesting NetServerEnum3 transaction
- US-CERT VU#342243: Microsoft Windows Server Message Block (SMB) fails to properly handle SMB_COM_TRANSACTION packets requesting NetShareEnum transaction
Reported:
Aug 22, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net