Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
NetBIOS Name Server Protocol Spoofing
A specific type of NetBIOS packet can be sent to a machine to cause that machine to relenquish its name. In such instances, user attempts to access that machine via its name would fail.
ITPro Today
July 26, 2000
1 Min Read
Reported July 27, 2000 by PGP Security and Sir Dystic of cDc
VERSIONS AFFECTED
Microsoft Windows NT 4.0 Workstation
Microsoft Windows NT 4.0 Server
Microsoft Windows NT 4.0 Server, Enterprise Edition
Microsoft Windows NT 4.0 Server, Terminal Server Edition
Microsoft Windows 2000
DESCRIPTION
By sending a specifically designed NetBIOS packet tosusceptible Windows machines,those machine can be made to relinquish their names or fail to successfully register theirnames on the network. Such an attack would render the machine unavailable to users thatattempt access via the machine's NetBIOS name.
VENDOR RESPONSE
Microsoft issued a FAQ,a Support Online article Q269239,and a patch for Windows 2000 to correct the problem. According toMicrosoft's bulletin, patches will be available "shortly" for NT 4.0 seriesoperating system, although no explanation for the delay was given.
User are urged to filter NetBIOS traffic(TCP 137, 138 and UDP 139) in order to prevent disruptions
CREDIT
Discovered by PGP Security and Sir Dystic of cDc
About the Author
You May Also Like
.png?width=700&auto=webp&quality=80&disable=upscale)